| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <200609062319.k86NJD2V001579@faron.mitre.org>
Date: Wed, 6 Sep 2006 19:19:13 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: maric_sasa@...oo.com
Cc: bugtraq@...urityfocus.com
Subject: Re: ZoneX 1.0.3 - Publishers Gold Edition Remote File Inclusion Vulnerability
>This vulnerability is not that dangerous because, firstly, if you want
>to exploit it, you must have exact file tree and correct name of the
>malicious script because that variable is never used alone but always
>in concatanation with script name and generic extension
In a typical PHP exploit scenario, the attacker could merely add a
null byte ("%00") to the phpbb_root_path parameter, which would then
cause the include call to ignore this extra file tree/name
information. Is there some reason why a null byte wouldn't work in
this situation?
- Steve
Powered by blists - more mailing lists