Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
[cosmoshop again] sql injection + view all files as admin user May 18 2006 06:32AM
innate gmx de
i am: l0om

page: www.excluded.org

product: cosmoshop

1) show all files as admin-user

2) sql injection

Cosmoshop - Lse (<= )V8.11.106

1) Show all files as an admin-user:

/cgi-bin/admin/bestellvorgang/edit_mailtexte.cgi?file=../../../../../../
../../../etc/passwd%00

/cgi-bin/admin/bestm...

[ more ]  




 

Privacy Statement
Copyright 2009, SecurityFocus