BugTraq
Back to list
|
Post reply
Modification For OpenSEF Remote file Inclusion
Aug 19 2006 01:18AM
Outlaw aria-security net
(1 replies)
Re: Modification For OpenSEF Remote file Inclusion
Aug 23 2006 10:51PM
Carsten Eilers (ceilers-lists gmx de)
Hi,
Outlaw (at) aria-security (dot) net [email concealed] schrieb am Sat, 19 Aug 2006 01:18:24 +0000:
>#Software: OpenSEF
>
>#Attack method: Remote File Inclusion
>
>#Description : OpenSEF is a Joomla component that extends the built-in
>SEF (Search Engine Friendly)
Is this <http://www.open-sef.org/>?
Which version did you test?
>
>#Proof of Concept:
>
>#http://www.site.com/sef.php?mosConfig_absolute_path=SHELL
In the actual Version (2.0.0-RC5_SP2) you could see
/** Ensure this file is being included by a parent file */
defined( '_VALID_MOS' ) or die( 'Direct access to this location is not
allowed.' );
at the top of the file, so it's impossible to call it
directly and manipulate any variable.
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
Outlaw (at) aria-security (dot) net [email concealed] schrieb am Sat, 19 Aug 2006 01:18:24 +0000:
>#Software: OpenSEF
>
>#Attack method: Remote File Inclusion
>
>#Description : OpenSEF is a Joomla component that extends the built-in
>SEF (Search Engine Friendly)
Is this <http://www.open-sef.org/>?
Which version did you test?
>
>#Proof of Concept:
>
>#http://www.site.com/sef.php?mosConfig_absolute_path=SHELL
In the actual Version (2.0.0-RC5_SP2) you could see
/** Ensure this file is being included by a parent file */
defined( '_VALID_MOS' ) or die( 'Direct access to this location is not
allowed.' );
at the top of the file, so it's impossible to call it
directly and manipulate any variable.
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>
[ reply ]