Heiko Wundram
09/11/06, 14:07
--nextPart1207102.F4UR4gOUQl
Content-Type: text/plain;
charset="iso-8859-15"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Am Sonntag, 5. November 2006 23:33 schrieb mahmood ali:
> <snip bullcrap>
Completely bogus.
If you look closely, the corresponding code in install.php3 is used to crea=
te=20
a config file which contains a statement setting $repertoire (from a user=20
input, so here is your injection attack for an install script, which is=20
pretty much what you want, I'd guess). Anyway, if you don't delete=20
install.php3 after the installation is complete, it's your own fault.
=2D-=20
=2D-- Heiko Wundram.
x|encon Support der
Gehrkens.IT GmbH
=46ON 0511-59027955 | http://www.gehrkens.it
=46AX 0511-59027956 | http://www.xencon.net
Gehrkens.IT GmbH
Mail=E4nder Strasse 2
30539 Hannover
--nextPart1207102.F4UR4gOUQl
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQBFT3Emp5nRf799dfYRAqpwAJ9RPPYB3k4f0Neatyjz5h jXKt0XEwCgh7Rd
sHw+zi0/9kuIotG43INKHbY=
=ImfQ
-----END PGP SIGNATURE-----
--nextPart1207102.F4UR4gOUQl--
Content-Type: text/plain;
charset="iso-8859-15"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Am Sonntag, 5. November 2006 23:33 schrieb mahmood ali:
> <snip bullcrap>
Completely bogus.
If you look closely, the corresponding code in install.php3 is used to crea=
te=20
a config file which contains a statement setting $repertoire (from a user=20
input, so here is your injection attack for an install script, which is=20
pretty much what you want, I'd guess). Anyway, if you don't delete=20
install.php3 after the installation is complete, it's your own fault.
=2D-=20
=2D-- Heiko Wundram.
x|encon Support der
Gehrkens.IT GmbH
=46ON 0511-59027955 | http://www.gehrkens.it
=46AX 0511-59027956 | http://www.xencon.net
Gehrkens.IT GmbH
Mail=E4nder Strasse 2
30539 Hannover
--nextPart1207102.F4UR4gOUQl
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQBFT3Emp5nRf799dfYRAqpwAJ9RPPYB3k4f0Neatyjz5h jXKt0XEwCgh7Rd
sHw+zi0/9kuIotG43INKHbY=
=ImfQ
-----END PGP SIGNATURE-----
--nextPart1207102.F4UR4gOUQl--