OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: mambo-phphop Product Scroller Module R.F.I

From: Carsten Eilers (ceilers-listsgmx.de)
Date: Fri Aug 18 2006 - 17:51:50 CDT


Hi,

Outlawaria-security.net schrieb am Fri, 18 Aug 2006 04:29:06 +0000:

>#Software: mambo-phphop Product Scroller Module

I found no mambo-phphop, did you mean mambo-phpshop,
now VirtueMart: <http://www.mambo-phpshop.net/>?

I found no mod_phpshop-Archive, so I tested some files
from the actual VirtueMart. They did the usual check for
direct calls (the lines

| defined( '_VALID_MOS' ) or die( 'Direct Access to this
| location is not allowed.' );
 
near the top of each file). So there is no inclusion
possible.

Where did you find the archive with the reported vulnerable
code? I would like to take a look on it.

Regards
  Carsten

--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>