Barryvan Compo Manager 0.5pre-1 Remote File Inclusion Vulnerability

2008-02-28T00:00:00
ID 1337DAY-ID-2706
Type zdt
Reporter MhZ91
Modified 2008-02-28T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===================================================================
Barryvan Compo Manager 0.5pre-1 Remote File Inclusion Vulnerability
===================================================================



--==+================================================================================+==--
--==+		barryvancompo-0.3 Remote File Inclusion                              +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: barryvancompo-0.3 Remote File Inclusion 
 Download: http://sourceforge.net/projects/barryvancompo/
 Bug: Remote File Inclusion
 Info: The barryvan compo manager is a PHP, Smarty and MySQL-based system for running, organising, and maintaining competitions. It is particularly designed for use within the computer music "scene".

[*]----------------------------------------------------------

barryvancompo-0.3 present a variable "pageURL" not definited in this file 

main.php
(and all files require it)

we can exploit it by the variable "pageURL", for example

http://www.example.com/main.php?pageURL=[Evil_Code]


[*]----------------------------------------------------------






#  0day.today [2018-04-02]  #