Doubt in MySQL Quick Admin <= 1.5.5 (COOKIE) Local File Inclusion Vulnerability POC posted on milworm

Type securityvulns
Reporter Securityvulns
Modified 2008-10-24T00:00:00


Greetings All,

I am trying to reproduce the issue, but php is reporting some error: like fail to open lang/../../../../../../../../../../etc/passwd%00; path=//lang.php.

vulnerable code is:


exploit is: ../../../../../../../../../../etc/passwd%00; path=/ as the value of vulnerable paramter.

exploit link is:

After observing this error i thought there must some issue with the application, so created a vulnerable php program whose details are:




Then i send a GET a request:

GET /vulnerable php?filename=lang/../../../../../../../../../../etc/passwd%00; path=/

still, i am observing same error.

This is happening because inside include function, there is an additon of /lang.php after the vulnerable parameter value in both case.

I am not able to understand how the author manage to view the contents of /etc/passwd by this method.

please help me out.

Thanks in advance.