[VIM] True: XOOPS Module XFsection (modify.php) Remote File Inclusion Vulnerability

[George A. Theall]

On 06/13/07 13:52, Steven M. Christey wrote:

> Is authentication controlled by a variable setting?  If so, then maybe an
> exploit could be made to overwrite that variable and bypass
> authentication, too.

The authentication check happens before GPC variables are extracted.

George
-- 
theall at tenablesecurity.com