| タイトル | SourceCodester 1.0 Information Disclosure |
|---|
| 説明 | Hello team,,
I have found vulnerability in SourceCodester Best House Rental Management System 1.0 inside the main page specifically inside "page" parameter however many vulnerability that has been reported about this one was XSS so I found other and more critical vulnerability when I inject this "page" parameter so I can disclose the source code of any page inside the system that's ends with "php" because vulnerability arise because of this line of code:
"<?php include $page.'.php' ?>" so I manage to exploit it and retrieve the source of any file I have created a fully working exploit visit this URL to get it and run it: https://pastebin.com/Qupf8YbH and then enter this password: 5yki3cXheX
after that you can run the script and it will ask you for file name for example after basic discovery of website like a normal user you will see different pages like login and more so just type the page you want from example after running the script type "loing" and you will get the source code of the login page |
|---|
| ソース | ⚠️ http://localhost/index.php?page= |
|---|
| ユーザー | 0xOlV0 (UID 78507) |
|---|
| 送信 | 2024年12月05日 19:56 (1 年 ago) |
|---|
| モデレーション | 2024年12月08日 21:37 (3 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 287276 [SourceCodester Best House Rental Management System 1.0 /index.php page 特権昇格] |
|---|
| ポイント | 17 |
|---|