[VIM] false? AN Guestbook LFI

str0ke str0ke at milw0rm.com
Fri Jun 26 15:43:48 UTC 2009


Ya false on this one, removed from the front end.

Steven M. Christey wrote:
> Researcher: CraCkEr
>
> http://www.milw0rm.com/exploits/9013
>
>
> The source code for 0.7.8 says:
>
>    if (__FILE__ == $_SERVER['SCRIPT_FILENAME'])
>         die("This file cannot be executed directly");
>    include_once ("languages/$g_lang");
>
> which seems to prevent direct request in my environment.
>
> This code is in 0.7 as well.  The file doesn't exist in 0.6.
>
> - Steve
>
>   


More information about the VIM mailing list