Re: CentiPaid <= 1.4.2 [$class_pwd] Remote File Include

To: firewall1954@xxxxxxxxxxx
Subject: Re: CentiPaid <= 1.4.2 [$class_pwd] Remote File Include
From: Francesco Laurita <francesco@xxxxxxxxxxxxxxxxxxxxxx>
Date: Mon, 30 Oct 2006 19:12:10 +0100
Cc: bugtraq@xxxxxxxxxxxxxxxxx
In-reply-to: <20061028064957.28226.qmail@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <20061028064957.28226.qmail@xxxxxxxxxxxxxxxxx>
User-agent: Mozilla Thunderbird 1.5.0.7 (Windows/20060909)

firewall1954@xxxxxxxxxxx ha scritto:

Affected software description :
Application : CentiPaid
version : 1.4.3
URL : http://www.centipaid.com/centi/download/centipaid_php-1.4.3.tar.gz

Code:centipaid_class.php

include($class_pwd.'/adodb/adodb.inc.php')

One line above:
$class_pwd = dirname(__FILE__);

$class_pwd is setted before include();

Mark it as bogus please
Regards

References:
- CentiPaid <= 1.4.2 [$class_pwd] Remote File Include
  - From: firewall1954

Prev by Date: Multiple Remote File Include
Next by Date: unreliable vulnerability reports en-masee [was:Re: vulnerability in Symantec products]
Previous by thread: CentiPaid <= 1.4.2 [$class_pwd] Remote File Include
Next by thread: Re: CentiPaid <= 1.4.2 [$class_pwd] Remote File Include
Index(es):
- Date
- Thread