|
|
BugTraq
[PHP] include() bypassing filter with php://input May 27 2004 09:07AM Himeur Nourredine (lostnoobs security-challenge com) (1 replies) Re: [PHP] include() bypassing filter with php://input May 28 2004 04:51AM Keary Suska (hierophant pcisys net) (1 replies) Re: [PHP] include() bypassing filter with php://input May 28 2004 07:27PM clez (bt_sf_com_20040528 clez net) (2 replies) Re: [PHP] include() bypassing filter with php://input May 28 2004 08:22PM bugtraq subscriber (bugtraq theorb net) |
|
Privacy Statement |
some page along these lines, as you suggest:
<HTML><HEAD></HEAD><BODY>
<!-- header stuff goes here -->
<?php
include ($_GET['page']);
?>
<!-- footer stuff goes here -->
</BODY></HTML>
... and if you code things in this remarkable way, you deserve to get
'sploited silly, vuln or no vuln. Why not go the whole hog and add the line
eval ($_GET['go_ahead_and_sploit_my_trousers_off']);
while you're at it ?
Ali
clez wrote:
> Hi there!
>
> i use php 4.3.5 and tried this "proof of concept". i assumed, that the
> form attribute "methode" is a typing mistake and adapted the exploit to
> get it working under a php 4.3.x default configuration (it's kinda
> paradox to use autoglobals in an exploit that aims to secure other
> products).
>
> but even this adapted version (see below) does not show anything on
> execution.
>
> this exploit seems to rely on a exploitable web service, that gets paths
> to include files from a get variable named "page".
>
> so this seems to me like a (fixed/changed) bug at the single service
> "www.exemple.com" (not to be mixed up with www.example.com from rfc
> 2606) and not a general php issue.
[ reply ]