Re: Morcego CMS <= 0.9.6 Remote File Inclue Vulnerability

[antonio@xxxxxxxxxxxxxxxxx]

The second Vulnerability, is also false:

includes/morcegoCMS/adodb/adodb.inc.php
Line: 3.245: include_once($path);


Context:

	function &NewDataDictionary(&$conn)
	{
		$provider = $conn->dataProvider;
		$drivername = $conn->databaseType;
		if ($provider !== 'native' && $provider != 'odbc' && $provider != 'ado') 
			$drivername = $conn->dataProvider;
		else {
			if (substr($drivername,0,5) == 'odbc_') $drivername = substr($drivername,5);
			else if (substr($drivername,0,4) == 'ado_') $drivername = substr($drivername,4);
			else 
			switch($drivername) {
			case 'oracle': $drivername = 'oci8';break;
			case 'sybase': $drivername = 'mssql';break;
			case 'access':
			case 'db2':		
				break;
			default:
				$drivername = 'generic';
				break;
			}
		}
		include_once(ADODB_DIR.'/adodb-lib.inc.php');
		include_once(ADODB_DIR.'/adodb-datadict.inc.php');
		$path = ADODB_DIR."/datadict/datadict-$drivername.inc.php";

		if (!file_exists($path)) {
			ADOConnection::outp("Database driver '$path' not available");
			return false;
		}
		include_once($path);