Two RCE exploits

Posted on 2008-02-09 19:38:22 by Iron

I don't do it often, but the vulnerability (Remote Code Execution) has been there for a damn long time and they didn't bother fixing it however it was really obvious. The vulnerable file is a 3rd party file named adodb-perf-module.inc.php, and is a part of ADOdb. The two affected pieces of software are Journalness and Open-Realty. The exploits can be found at milw0rm: Open-Realty and Journalness. Since ADOdb is used in a lot of PHP applications, don't be surprised if others are affected too.

Comments

spider:

nice one ... huh
perl or.pl
#
# Open-Realty <= 2.4.3 Remote Code Execution exploit
# By Iron - randombase.com
# Greets to everyone at RootShell Security Group
#
# Example target url: http://www.target.com/openrealtydir/
Target url?www.openrealty.co.za
PHP code to evaluate? ~ s/(<\?php|\?>|<\?)//ig

####################

####################

got it ... lousy fuckin c exec expl

n00b:

exploit works fine, tested on localhost

Ric:

what in the hell is an exploit, you guys?

Iron:

"In computer security, an exploit is a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). ..." - wikipedia

Your name:

Your website: (optional)

Comment: