Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:14455
HistorySep 28, 2006 - 12:00 a.m.

Comdev Vote Caster 3.1 :) <= Remote File Inclusion

2006-09-2800:00:00
vulners.com
16

±-------------------------------------------------------------------
+

  • Comdev Vote Caster 3.1 :) <= Remote File Inclusion

±-------------------------------------------------------------------
+

±-------------------------------------------------------------------
+

  • Code include.php:
  • include($path["docroot"]."common/wce.login.php");

±-------------------------------------------------------------------
+

  • $path["docroot"] is not properly sanitized before being used.
  • The bug is in the "Comdev CSV Importer" Package for Comdev CSV Importer.

±-------------------------------------------------------------------
+

  • Solution:
  • Add this line to your php-file:
  • $path["docroot"] ="user/dir" //Your root path

±-------------------------------------------------------------------

±-------------------------------------------------------------------

  • [W]orld [D]efacers [T]eam
  • Greets:
  • || rUnViRuS || - || papipsycho || - || HeX || - || Linux Master || BLaCKWHITE ||
  • || Pro Hacker ||

±------------------------[ W D T ]----------------------------------