bugtraq - Re: Amr Talkbox talkbox.PHP - Remote File Include Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 15 Jun 2006 02:26:37 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: Amr Talkbox talkbox.PHP - Remote File Include Vulnerabilities

SpC-x said:

> # Amr Talkbox talkbox.PHP - Remote File Include Vulnerabilities
>
> ...
> # if ($lang == "eng") {
> # include ("$direct/lang_eng.txt");
> # } elseif ($lang =="ita") {
> # include ("$direct/lang_ita.txt");

However, looking at the source code  as available on
http://scripts.ringsworld.com/chat-scripts/amr-talkbox/ , with source
files dated May 2005 and earlier, we have:

   $direct = "languages";									//--->	The folder/directory that contain the language kits.

   if ($lang == "eng") {
     include ("$direct/lang_eng.txt");
   } elseif ($lang =="ita") {
     include ("$direct/lang_ita.txt");
   }

in other words - not exploitable.

- Steve