bugtraq - Re: mambo-phphop Product Scroller Module R.F.I

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 19 Aug 2006 00:51:50 +0200
From: "Carsten Eilers" <ceilers-lists@....de>
To: <Outlaw@...a-security.net>, <bugtraq@...urityfocus.com>
Subject: Re: mambo-phphop Product Scroller Module R.F.I

Hi,

Outlaw@...a-security.net schrieb am Fri, 18 Aug 2006 04:29:06 +0000:

>#Software: mambo-phphop Product Scroller Module                         

I found no mambo-phphop, did you mean mambo-phpshop,
now VirtueMart: <http://www.mambo-phpshop.net/>?

I found no mod_phpshop-Archive, so I tested some files
from the actual VirtueMart. They did the usual check for
direct calls (the lines 

| defined( '_VALID_MOS' ) or die( 'Direct Access to this
| location is not allowed.' );

near the top of each file). So there is no inclusion 
possible.

Where did you find the archive with the reported vulnerable
code? I would like to take a look on it.

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>