Bugtraq mailing list archives
Re: file include exploits in nucleus 3.23
From: nukedx () nukedx com
Date: 17 Jun 2006 16:21:46 -0000
These files are not vulnerable, I checked the codes of them and i see that for action.php, include('./config.php'); // common functions include_once($DIR_LIBS . 'ACTION.php'); media.php, include('../config.php'); include($DIR_LIBS . 'MEDIA.php'); // media classes server.php-> include("../../config.php"); // include Nucleus libs and code include($DIR_LIBS . "xmlrpc.inc.php"); DIR_LIBS already defined by config.php.. also for api_metaweblog.inc.php this is not working directly through browser it just have functions and i think you see that and thought its vulnerable. function _newMediaObject($blogid, $username, $password, $info) { ... ... ... // - add file to media library include_once($DIR_LIBS . 'MEDIA.php'); // media classes ... ... ... } Please post correct vulnerabilities and be a real. Dont post reports for being famous nowadays we are having this problem in BT mailing list. Also please dont give me credits about your exploits. (Not for you SWEET) just for who send greetz to me. Regards, Mustafa Can Bjorn IPEKCI
Current thread:
- file include exploits in nucleus 3.23 gamr-14 (Jun 16)
- <Possible follow-ups>
- Re: file include exploits in nucleus 3.23 nukedx (Jun 21)