4images Forum & Community

4images Issues / Ausgaben => Discussion & Troubleshooting => Topic started by: ReMoN on September 17, 2010, 06:57:22 PM

Title: Bug in file global.php 1.7.8
Post by: ReMoN on September 17, 2010, 06:57:22 PM

i found this warning in Arabic website

-----------------------------------------------------
Exploit Title: [4image 1.7.8 Remote File Include ]

Tested on: [Windows XP]

Version: [v 1.7.8 ]

Exploit: http://target/4images1.7.8/4images/global.php?db_servertype=[SHeLL]

-----------------------------------------------------
my PHP experience is not that good to search and fix Bugs and the Arabic forum here have no support

my question : is there is really Bug in global.php or it had been fixed ?

Title: Re: Bug in file global.php 1.7.8
Post by: V@no on September 17, 2010, 08:09:24 PM

Can you post the site you found this from?

But what you showed doesn't look like any problems, because global.php cannot be executed directly as in your example.

Title: Re: Bug in file global.php 1.7.8
Post by: ReMoN on September 17, 2010, 08:46:48 PM

English Website

http://www.exploit-db.com/exploits/14712/

Arabic Website

http://forum.orbitdesign.net/showthread.php?t=8266

Title: Re: Bug in file global.php 1.7.8
Post by: mody64 on September 22, 2010, 10:05:46 PM

is this right , please ?

Title: Re: Bug in file global.php 1.7.8
Post by: V@no on September 22, 2010, 10:26:11 PM

First of all, welcome to 4images forum.

Secondly, please be patient and read forum rules (that is about your PM and unnecessary reporting topic)

As of your question, personally I don't see any problems in global.php or anything related to the exploit posted. However I may lack of knowledge to actually confirm this...don't take my word for it just yet. This being investigated.

Title: Re: Bug in file global.php 1.7.8
Post by: mody64 on September 22, 2010, 11:45:54 PM

thank you admin for your reply

i wait your reply after investigated

best wishes

Title: Re: Bug in file global.php 1.7.8
Post by: kai on September 23, 2010, 09:29:32 AM

That's a fake.

global.php can't be accessed directly. Give it a try:
]http://demo.4homepages.de/global.php?db_servertype=[SHeLL] (http://demo.4homepages.de/global.php?db_servertype=[SHeLL)

Title: Re: Bug in file global.php 1.7.8
Post by: mody64 on September 23, 2010, 12:05:33 PM

thanks kai

i pleased to heared that

i hope if appear any thing about that , Let us know

Thank you again   :D