Problem: Remote File Include
Discovered by: beford <xbefordx gmail com>
Statistics software based on PHP which does not require any database
support but just uses flat files. Daily + monthly visits, which pages, from
where, browsers and OSs are listed and visually presented
A remote user can supply a specially crafted URL to cause the target
system to include and execute arbitrary PHP code from a remote
location. A remote user can execute arbitrary PHP code and operating
system commands on the target system with the privileges of the
target web service.
The vulnerable file is kopf.php
$rootdir is not being declared before using it in the include() function.
Proof of Concept URL
Zetha - http://odiameporsernegro.org
fallen - x33x37.org