BugTraq
Back to list
|
Post reply
ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include
Aug 20 2006 07:52AM
h4ck3riran yahoo com
(1 replies)
Re: ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include
Aug 23 2006 10:51PM
Carsten Eilers (ceilers-lists gmx de)
Hi,
h4ck3riran (at) yahoo (dot) com [email concealed] schrieb am Sun, 20 Aug 2006 07:52:31 +0000:
>> ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include
>
>----------------------------------------------
>
>>
>
>>Source :
>
>> include($tcms_administer_site.'/tcms_global/database.php')
This is from index.php?
Near the top of this script the variable is initalized:
| include_once('site.php');
| $tcms_administer_site = $tcms_site[0]['path'];
After that I found no way to manipulate $tcms_administer_site,
so I see no vulnerability.
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
h4ck3riran (at) yahoo (dot) com [email concealed] schrieb am Sun, 20 Aug 2006 07:52:31 +0000:
>> ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include
>
>----------------------------------------------
>
>>
>
>>Source :
>
>> include($tcms_administer_site.'/tcms_global/database.php')
This is from index.php?
Near the top of this script the variable is initalized:
| include_once('site.php');
| $tcms_administer_site = $tcms_site[0]['path'];
After that I found no way to manipulate $tcms_administer_site,
so I see no vulnerability.
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>
[ reply ]