[VIM] Pluck Local File Inclusion
str0ke at milw0rm.com
Mon Jul 14 20:00:20 UTC 2008
George A. Theall wrote:
> Has anyone looked at the advisory about local file include issues in
> Pluck (BID 30218 /
> http://archives.neohapsis.com/archives/bugtraq/2008-07/0106.html)? It
> seems like the issues aren't generally exploitable if you call the
> affected script directly since the directories embedded in calls to
> include() -- "data/inc/lang", "data/content", and "data/blog" -- are
> located at the base of the application's install directory rather than
> under "data/inc/themes". Or do I just mis-understand how PHP sets the
> current working directory when calling a script?
Your right it shouldn't work, but under windows its a different story
(at least was in the past).
I believe its like so.
ls -la data/../../../../../../etc/passwd << won't work if the data
directory doesn't exist.
dir data\..\..\..\..\..\..\boot.ini << works with or without the directory.
More information about the VIM