OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
MyBB 1.2 Local File Incusion

o.y.6hotmail.com
Date: Mon Jan 30 2006 - 04:38:29 CST


Invalid characters removed from From: o.y.6hotmail.com, |securityfocus.com,

#### D3vil-0x1 MyBB Bug ###
## Local File Inclusion
##
## MyBB 1.2 -> Admin Can Include Local File :)

## File :- admin/plugins.php
                                
                                        Line :- 51
//*

        if($mybb->input['action'] == "activate")

        {

        $codename = $mybb->input['plugin']; << Input From POST

        $file = $codename.".php"; << Set File Type [ we can remove the type by NULL ( %00 ) ]

        if($mybb->input['activate'])

        {

        .....
        .....

        }

        elseif($mybb->input['deactivate'])

        {

        .....
        .....

        }

        include "./inc/plugins/$file"; << Include BIG BUG :P

*//
#---------------------------------------------------------#