[VIM] true: ACGV Annu (rubrik) LFI

Steven M. Christey coley at mitre.org
Wed May 9 17:06:10 UTC 2007


Researcher: BeyazKurt
Ref: milw0rm 3867
     http://www.milw0rm.com/exploits/3867


theme/acgv.php contains:

  include("config/config.inc.php");
  include("config/function.inc.php");
  ...
      <td align="center"><? include("templates/$rubrik".".html"); ?></td>

config.inc.php and function.inc.php do not define $rubrik.

- Steve


More information about the VIM mailing list