sorry..miss look for "./" prefix in file_exists call. so it will not work after all.. :-)
On Tue, 31 Oct 2006 18:24:56 +0800, pokley <saleh@xxxxxxxxxxxxxxxxxxx> wrote:
In PHP 5.x file_exists function have support for Protocols/Wrappers . So setting $chemin to ftp://blablablab.com/ will work in this case On Tue, 31 Oct 2006 05:18:58 +0800, Tamriel <tamriel@xxxxxxx> wrote:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I would quote the whole code arround the includes, like: [...] if (file_exists("./".$chemin."/config.php")){ include ("$chemin/config.php"); include ("$chemin/options.inc.php"); include ("$chemin/freenews_functions.inc.php"); } [...] You could only include files on the same server, not remote and not a shell.txt. MoHaNdKo wrote:######################################################## # #freenews---> fileinclude ############################### # #include ("$chemin/config.php"); #include ("$chemin/functions.inc.php"); #include ("$chemin/options.inc.php"); #****************************************** #name: MoHaNdKo #E-mail : xp1o@xxxxxxx # # #******************** #exploit: # www.****.com/path/aff_news.php?chemin=shell.txt? # # #******************** #Greatz: # www.xp10.com & www.d4eg.org & www.dmazika.org # # www.tryag.com-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32) iD8DBQFFRmxCqBhP+Twks7oRCqoAAJ9YaqJn7Mdptjgc17uIV76Qcy5eVwCfRNpf DmmJNRb3gp/R32Dq8dINQks= =BGMI -----END PGP SIGNATURE-----
-- SCAN CONFIDENTIALITY NOTICE & DISCLAIMER The contents of this e-mail and its attachment, if any ("message") are intended for the named addressee only and may contain confidential information. If you are not the named addressee, you must not copy this message or disclose it to any other person. If you received this message by error, you should delete this message immediately and notify the sender by return e-mail. SCAN Associates Berhad, its subsidiaries and/or group companies ("SCAN") disclaim all liability for any error, loss or damage arising from this message being infected by computer virus or other malicious software. The views and other information in this message that do not relate to theofficial business of SCAN shall not be deemed provided nor endorsed by SCAN.