Amber Script Show_Content.PHP本地文件包含漏洞

Amber Script是一款基于PHP的WEB应用程序。 Amber Script不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'ShowContent.PHP'脚本对用户提交的WEB参数缺少过滤，提交包系统文件作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 Amber Script 1.0 目前没有解决方案提供： http://www.pakfiles.info/Download-amber-script-2.html...

amber-lfi.txt

+By CrackersChild+ Script.......: Amber Script 1.0 Download.....: http://rapidshare.com/files/54891799/AmberScript1.0.rar Nulled Author.......: CrackersChild | [email protected] & [email protected] Class........: Local File Inclusion Demo.........:...

CVE-2007-6129: Improper Input Validation

Directory traversal vulnerability in scripts/include/showcontent.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the id parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share...