Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

PHPMyTourney Remote file include Vulnerability

from [security] Network Security [Permanent Link]
Subject: PHPMyTourney Remote file include Vulnerability
Date: 29 Feb 2008 09:10:58 -0000 
Hello

PHPMyTourney Remote file include Vulnerability

Discovered By : HACKERS PAL
Copy rights : HACKERS PAL
Website : http://www.soqor.net
Email Address : security@soqor.net

home page : http://phpmytourney.sourceforge.net

Script : PHPMyTourney


vulnerable file : phpmytourney/sources/tourney/index.php

code
         $page = $_GET['page'];
         if(isset($page))
            include($page . '.php');
         else
            echo("must specify a page ");
lines 45-49

fast solution
replace with

if(file_exists($page . '.php') and !eregi(".",$page) and !eregi(":",$page) and 
!eregi("/",$page))
{
            include($page . '.php');
}
else
{
            echo("must specify a page ");
}

phpmytourney/sources/tourney/index.php?page=[Evil-Script]



#WwW.SoQoR.NeT
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • PHPMyTourney Remote file include Vulnerability, security <=
Previous by Date:  Re: Loginwindow.app and Mac OS X, Jacob Appelbaum
Next by Date:  Ghostscript buffer overflow, Chris Evans
Previous by Thread:  Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials, brad . antoniewicz
Next by Thread:  Ghostscript buffer overflow, Chris Evans
Indexes:  [Date] [Thread] [Top] [All Lists]