[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <45B73063.6060708@securenetwork.it>
Date: Wed, 24 Jan 2007 11:09:39 +0100
From: Stefano Zanero <s.zanero@...urenetwork.it>
To: me you <r.5.7@...mail.com>, bugtraq@...urityfocus.com
Subject: Re: Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include
Vulnerability
> Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include
> Vulnerability
Bogus
> code :.
>
> require_once $include_path."/admin/config.inc.php";
> require_once $include_path."/lib/$DB_CLASS";
> require_once $include_path."/lib/image.class.php";
> require_once $include_path."/lib/template.class.php";
Line above:
$include_path = dirname(__FILE__);
So your proposed "exploit" does not work.
Please STOP reporting fake web vulns.
Stefano
Powered by blists - more mailing lists