bugtraq - Re: pMachine (PHP) : Include() Security Hole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 15 Jun 2003 10:07:56 +0200
From: martin f krafft <madduck@...duck.net>
To: bugtraq@...urityfocus.com
Subject: Re: pMachine (PHP) : Include() Security Hole

also sprach Frog Man <leseulfrog@...mail.com> [2003.06.14.1848 +0200]:
> This will work if register_globals is ON *OR* OFF.

Right, because:

>   while(list($var,$val)=each($HTTP_COOKIE_VARS))
>   while(list($var,$val)=each($HTTP_GET_VARS))
>   while(list($var,$val)=each($HTTP_POST_VARS))
>   while(list($var,$val)=each($HTTP_SERVER_VARS))

you are effectively "turning it on", so to speak.

> include ("{$pm_path}config$sfx");

then of course, sfx is going to be a variable, if it's passed into
the script via GET_VARS.

your mistake is using a variable that wasn't explicitly initialised.

other than that i fail to see why this is somethign special.

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@...duck

keyserver problems? http://keyserver.kjsl.com/~jharris/keyserver.html
get my key here: http://madduck.net/me/gpg/publickey

bill gates, 1984: "640 k ought be enough"
bill gates, 1995: "the internet is not a primary goal for pc usage"
bill gates, 1999: "linux has no impact on microsoft's strategy"

Content of type "application/pgp-signature" skipped