[Full-disclosure] Re: runcms/e-xoops 1.1A and below file upload vulnerability

From: pokley (pokleyzz_at_scan-associates.net)
Date: 04/07/05

  • Next message: Miracle Maker: "[Full-disclosure] Nokia Terminal Gateway default installation vulnerability" 
    To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Date: Thu, 07 Apr 2005 12:57:47 +0800

    Proof of concept

    On Wed, 06 Apr 2005 14:53:18 +0800, pokley <pokleyzz@scan-associates.net>
    wrote:

    > Products: runcms/e-xoops 1.1A (http://www.runcms.org)
    >
    > Summary: runcms/e-xoops 1.1A and below file upload vulnerability
    >
    > Description
    > ===========
    > runcms/e-xoops is an extensible, OO (Object Oriented), easy to use
    > dynamic web content management system
    > written in PHP. runcms/e-xoops is the ideal tool for developing small to
    > large dynamic community websites,
    > intra company portals, corporate portals, weblogs and much more.
    >
    > Details
    > =======
    > User may upload any file through file upload function .Example thought
    > avatar upload when "Allow custom
    > avatar upload" is set to "Yes" in "Custom avatar settings". This setting
    > is not on by default installation.
    > This is cause of fileupload class will recursively save any file suppied
    > by user in upload function.
    >
    > -- upload file.php line 240
    >
    > if ( !empty($HTTP_POST_FILES) ) {
    > foreach ($HTTP_POST_FILES as $filename => $value) {
    >
    >
    > Fix
    > ===
    > Fix available from runcms/e-xoops forum.
    > http://www.runcms.org/public/modules/newbb_plus/viewtopic.php?topic_id=3493&forum=16
    >
    > Vendor Response
    > ===============
    > 30th March 2005 - Developer contacted through private msg
    > 30th March 2005 - Developer reply for testing result
    > 31st March 2005 - Developer announce to user to disable avatar upload
    > setting
    > 5th April 2005 - Fix Available
    >
    > 

    -- 
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
    URL :
    valid avatar file:
    php script file:
    upload dir:
    extension:

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Miracle Maker: "[Full-disclosure] Nokia Terminal Gateway default installation vulnerability"