Hi,

h4ck3riran@yahoo.com schrieb am Sun, 20 Aug 2006 07:52:31 +0000:

>> ToendaCMS <=3D 1.0.3 -(tcms=5Fadminister=5Fsite) Remote File Include
>
>----------------------------------------------
>
>>
>
>>Source :
>
>> include($tcms=5Fadminister=5Fsite.'/tcms=5Fglobal/database.php')

This is from index.php=3F

Near the top of this script the variable is initalized:

|=A0include=5Fonce('site.php');
|=A0$tcms=5Fadminister=5Fsite =3D $tcms=5Fsite[0]['path'];

After that I found no way to manipulate $tcms=5Fadminister=5Fsite,
so I see no vulnerability.

Regards
Carsten


--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>