| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 19 May 2007 01:06:11 -0400 From: kefka <kefka@...inbeardsucks.com> To: gahmad@...urityfocus.com Cc: full-disclosure <full-disclosure@...ts.grok.org.uk> Subject: Re: PsychoStats 3.0.6b and prior Correction: it should be $pathto*psycho*stats/server.php?newcss=styles.css&newtheme=%00 and $pathto*psycho*stats/includes/smarty/Smarty.class.php Took a passing glance at hlstats a few night prior. I can provide more excuses upon request. >> newtheme variable only expects "sane" behaivor, no arguement or an >> arguement with any special character, etc.. will cause it to error and >> display the full path to $pathtohlstats/includes/smarty/Smarty.class.php >> >> $pathtohlstats/server.php?newcss=styles.css&newtheme=%00 >> >> Ex: Warning: Smarty error: unable to read resource: "server.html" in >> $pathtohlstats/includes/smarty/Smarty.class.php on line 1088 >> >> >> _______________________________________________ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists