Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: gcards (languagefile) <= Remote File Include
From: str0ke <str0ke () milw0rm com>
Date: Wed, 11 Oct 2006 14:55:58 -0500

Exploit
gcards/admin/addnews.php?languagefile=shell code

gCards Version 1.13
http://www.gregphoto.net/gcards/index.php

22 include_once('../config.php');                     # the variable is defined
23 include_once('../inc/UIfunctions.php');    # no variable change
24 include_once('loginfunction.php');         # just a couple functions
25 include_once('../inc/smileyClass.php');    # just a single class
26 include_once("../inc/".$languageFile);     # the only include with $languageFile

$languageFile is defined on line 93 of config.php, by default to
"language_en.php"

Maybe im missing where the vulnerability is?

/str0ke


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault