> # Simpnews <= All version - Remote File Include Vulnerabilities
> # require_once($path_simpnews.'/langchk.php');
> # include_once('./language/lang_'.$act_lang.'.php');
> # require_once('./includes/get_settings.inc');
> # require_once('./includes/wap_get_settings.inc');

> # Vulnerable :
> # http://www.victim.com/Simpnews/wap_short_news.php?path_simpnews=Command-
Shell

Was this verified on a running site or was this just source inspected?
The below shouldn't be vulnerable with config.php declaring $path_simpnews.

CODE
--------------------------------------
require_once('./config.php');
require_once('./functions.php');
if(!isset($category))
$category=0;
require_once($path_simpnews.'/langchk.php');
include_once('./language/lang_'.$act_lang.'.php');
require_once('./includes/get_settings.inc');
require_once('./includes/wap_get_settings.inc');

config.php
--------------------------------------
$path_simpnews = getenv("DOCUMENT_ROOT")."/simpnews";

/str0ke

[ reply ]