Exploit phPay 2.2.1 - Windows Installations Local File Inclusion

[Exploiter]

EDB-ID

30887

Проверка EDB

1. Пройдено

Автор

MICHAEL BROOKS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-6471

Дата публикации

2007-12-15

source: https://www.securityfocus.com/bid/26881/info

phPay is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. The vulnerability resides in code that was intended to protect against file-include attacks. It was found that the protection routines may be bypassed on Windows installations.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts. 

http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\\..\\admin\\.htaccess

The following example was provided in cases where the PHP 'magic_quotes_gpc' directive is enabled:

http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\..\admin\.htaccess