[30441] in bugtraq
Re: pMachine (PHP) : Include() Security Hole
daemon@ATHENA.MIT.EDU (martin f krafft)
Tue Jun 17 10:16:03 2003
Date: Sun, 15 Jun 2003 10:07:56 +0200
From: martin f krafft <madduck@madduck.net>
To: bugtraq@securityfocus.com
Message-ID: <20030615080756.GA7803@piper.madduck.net>
Mail-Followup-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="k+w/mQv8wyuph6w0"
Content-Disposition: inline
In-Reply-To: <Law15-F19rRjbDt3Hvo00076de6@hotmail.com>
--k+w/mQv8wyuph6w0
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
also sprach Frog Man <leseulfrog@hotmail.com> [2003.06.14.1848 +0200]:
> This will work if register_globals is ON *OR* OFF.
Right, because:
> while(list($var,$val)=3Deach($HTTP_COOKIE_VARS))
> while(list($var,$val)=3Deach($HTTP_GET_VARS))
> while(list($var,$val)=3Deach($HTTP_POST_VARS))
> while(list($var,$val)=3Deach($HTTP_SERVER_VARS))
you are effectively "turning it on", so to speak.
> include ("{$pm_path}config$sfx");
then of course, sfx is going to be a variable, if it's passed into
the script via GET_VARS.
your mistake is using a variable that wasn't explicitly initialised.
other than that i fail to see why this is somethign special.
--=20
martin; (greetings from the heart of the sun.)
\____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
=20
keyserver problems? http://keyserver.kjsl.com/~jharris/keyserver.html
get my key here: http://madduck.net/me/gpg/publickey
=20
bill gates, 1984: "640 k ought be enough"
bill gates, 1995: "the internet is not a primary goal for pc usage"
bill gates, 1999: "linux has no impact on microsoft's strategy"
--k+w/mQv8wyuph6w0
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQE+7ClcIgvIgzMMSnURAj4WAJ0Wj7dqSoEn04MdzZ/CUnBXRxkbAwCcCuWm
PwRsoR19giuJVKHvV9aHd2Y=
=5XOn
-----END PGP SIGNATURE-----
--k+w/mQv8wyuph6w0--
