Re: discloser 0.0.4 Remote File Inclusion (with Exploit)

[Carsten Eilers]

Hi,

dr.t3rr0r1st@yahoo.com schrieb am Wed, 16 Aug 2006 21:51:24 +0000:

>$req =3D HTTP::Request->new(GET =3D>$bpath.
>'plugins/plugins.php=3F>type=3D'.$cmdo.'=3F&'.$bcmd.'=3D'.$cmd)
>or die "\n Could not connect !\n";

With other words: You want to use parameter 'type' in
plugins/plugins.php.

But in plugins/plugins.php we have

|=A0<=3F
|=A0
|=A0// add additional types to the below array.
|=A0
|=A0 $avail=5Ftypes =3D array('short', 'long');
|=A0 $=5FSESSION['avail=5Ftypes'] =3D $avail=5Ftypes;
|=A0 foreach ($avail=5Ftypes as $type) {
|=A0=09include($type . ".plugin.php");
|=A0}
|=A0
|=A0
|=A0=3F>

As you can see is $type set to values of $avail=5Ftypes,
which is intialized two lines above. So there ist no
way to manipulate either $type or $avail=5Ftypes.

So there is no vulnerability, here.

Regards
Carsten


--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>