[39981] in bugtraq
PhpList Sql Injection and Path Disclosure
daemon@ATHENA.MIT.EDU (thegreatone2176@yahoo.com)
Thu Jul 28 16:11:51 2005
Date: 28 Jul 2005 00:01:05 -0000
Message-ID: <20050728000105.14455.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: thegreatone2176@yahoo.com
To: bugtraq@securityfocus.com
-----------------------------------------
PhpList Sql Injection and Path Disclosure
-----------------------------------------
Vulnerabilities
---------------
1) There is an sql injection in the id parameter of public_html/lists/admin/?page=admin&id=INJECT HERE
2) Because of the heavy use of classes without proper checking of whether the script is directly called there is many path disclosures. The following pages are all affected under the preceding directory.
public_html/lists/admin:
about.php
connect.php
domainstats.php
usercheck.php
admin/commonlib/pages:
attributes.php
dbcheck.php
importcsv.php
user.php
usermgt.php
users.php
public_html/lists/admin/plugins:
helloworld.php
sidebar.php
public_html/lists/admin/plugsins/defaultplugin:
main.php
Solution
--------
1) cleanse the id parameter before processing
2) check to see if the script is being directly called and then have the script die
Credit
------
thegreatone2176@yahoo.com
