Bugtraq mailing list archives
Re: Web Apps- Rad Upload Version 3.02 Remote File Include Vulnerability
From: e4c5 () kelanisearch com
Date: 21 Feb 2007 18:29:35 -0000
1) Obviously the poster is unaware that PHP register_globals have been off for a long long time and thus a value of the save_path cannot be passed in through the url as described by the poster. http://au2.php.net/manual/en/security.globals.php 2) He has failed to notice the $save_path is set with in the upload.php script and only the website owner can change that. 3) upload.php is not Rad Upload! it's a sample script.
Current thread:
- Re: Web Apps- Rad Upload Version 3.02 Remote File Include Vulnerability e4c5 (Feb 22)