Killer Protection 1.0 - Information Disclosure

source: https://www.securityfocus.com/bid/5905/info

The Killer Protection PHP script is prone to an information-disclosure issue. Reportedly, unauthorized users can access sensitive user data by requesting the 'vars.inc' file in a malicious HTTP request.

Exploiting this issue may allow attackers to access sensitive usernames and passwords, which could be used in future attacks.


http://[target]/vars.inc

and

http://[target]/protection.php?mode=display&username=[LOGIN]&password=[PASSWORD]