[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Re: freenews---> fileinclude
From:       pokley <saleh () scan-associates ! net>
Date:       2006-10-31 10:27:58
Message-ID: op.th97cwanuza017 () pokleyzz-asus
[Download RAW message or body]

sorry..

miss look for "./" prefix in file_exists call. so it will not work after  
all.. :-)


On Tue, 31 Oct 2006 18:24:56 +0800, pokley <saleh@scan-associates.net>  
wrote:

> In PHP 5.x file_exists function have support for Protocols/Wrappers .
> So setting $chemin to ftp://blablablab.com/ will work in this case
>
> On Tue, 31 Oct 2006 05:18:58 +0800, Tamriel <tamriel@gmx.net> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> I would quote the whole code arround the includes, like:
>>
>> [...]
>> if (file_exists("./".$chemin."/config.php")){
>>     include ("$chemin/config.php");
>>     include ("$chemin/options.inc.php");
>>     include ("$chemin/freenews_functions.inc.php");
>> }
>> [...]
>>
>> You could only include files on the same server, not remote and not a
>> shell.txt.
>>
>>
>> MoHaNdKo wrote:
>>> ########################################################
>>> #
>>> #freenews---> fileinclude
>>> ###############################
>>> #
>>> #include ("$chemin/config.php");
>>> #include ("$chemin/functions.inc.php");
>>> #include ("$chemin/options.inc.php");
>>> #******************************************
>>> #name: MoHaNdKo
>>> #E-mail : xp1o@msn.com
>>> #
>>> #
>>> #********************
>>> #exploit:
>>> #            www.****.com/path/aff_news.php?chemin=shell.txt?		
>>> #
>>> #
>>> #********************
>>> #Greatz:
>>> #         www.xp10.com & www.d4eg.org & www.dmazika.org
>>> #
>>> #                             www.tryag.com
>>
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.5 (MingW32)
>>
>> iD8DBQFFRmxCqBhP+Twks7oRCqoAAJ9YaqJn7Mdptjgc17uIV76Qcy5eVwCfRNpf
>> DmmJNRb3gp/R32Dq8dINQks=
>> =BGMI
>> -----END PGP SIGNATURE-----
>>
>
>
>



-- 
SCAN CONFIDENTIALITY NOTICE & DISCLAIMER

The contents of this e-mail and its attachment, if any ("message") are
intended for the named addressee only and may contain confidential
information. If you are not the named addressee, you must not copy this
message or disclose it to any other person. If you received this message by
error, you should delete this message immediately and notify the sender by
return e-mail.


SCAN Associates Berhad, its subsidiaries and/or group companies ("SCAN")
disclaim all liability for any error, loss or damage arising from this
message being infected by computer virus or other malicious software. The
views and other information in this message that do not relate to the
official business of SCAN shall not be deemed provided nor endorsed by  
SCAN.

 

[prev in list] [next in list] [prev in thread] [next in thread]