Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863572896

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/49525/info

Pluck is prone to multiple file-include and a file-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

An attacker can exploit local file-disclosure vulnerability to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Pluck 4.7 is vulnerable; other versions may also be affected. 

1-File Inclusion:
 
include(ALBUMS_DIR.'/'.$_GET['album'].'.php');
 
Require:
 
if (file_exists(ALBUMS_DIR.'/'.$_GET['album'].'.php')) {
function albums_pages_site() {
 
2-File Inclusion
 
include (ALBUMS_DIR.'/'.$album['seoname'].'.php');
foreach ($albums as $album) {
$albums  = albums_get_albums();
 
3-File Disclosure
 
echo readfile('../../settings/modules/albums/'.$image);
$image = $_GET['image'];
 
requires:
 
if (file_exists('../../settings/modules/albums/'.$image)) {