On 11/18/06, Stefano Zanero <[EMAIL PROTECTED]> wrote:
[EMAIL PROTECTED] wrote:> # Phpjobscheduler 3.0 - Multiple Remote File Include by Firewall Bogus > # Code: > include_once($installed_config_file) include_once("functions.php"); some lines above includes a file which statically sets that variable, so > # ExPloit : None of these work. Please stop reporting bogus vulnerabilities ! Thanks ! Stefano
$installed_config_file = "config.inc.php"; if ($_REQUEST) foreach ($_REQUEST AS $key => $value) $$key = $value; The line below the variable being defined is what makes this vulnerable. Be safe, /str0ke
