bugtraq - Re: runcms/e-xoops 1.1A and below file upload vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 07 Apr 2005 12:57:47 +0800
From: pokley <pokleyzz@...n-associates.net>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Re: runcms/e-xoops 1.1A and below file upload
	vulnerability

Proof of concept

On Wed, 06 Apr 2005 14:53:18 +0800, pokley <pokleyzz@...n-associates.net>  
wrote:

> Products: runcms/e-xoops 1.1A (http://www.runcms.org)
>
> Summary:  runcms/e-xoops 1.1A and below file upload vulnerability
>
> Description
> ===========
> runcms/e-xoops is an extensible, OO (Object Oriented), easy to use  
> dynamic web content management system
> written in PHP. runcms/e-xoops is the ideal tool for developing small to  
> large dynamic community websites,
>   intra company portals, corporate portals, weblogs and much more.
>
> Details
> =======
> User may upload any file through file upload function .Example thought  
> avatar upload when  "Allow custom
> avatar upload" is set to "Yes" in "Custom avatar settings". This setting  
> is not on by default installation.
> This is cause of fileupload class will recursively save any file suppied  
> by user in upload function.
>
> -- upload file.php line 240
>
> if ( !empty($HTTP_POST_FILES) ) {
> 	foreach ($HTTP_POST_FILES as $filename => $value) {
>
>
> Fix
> ===
> Fix available from runcms/e-xoops forum.
> http://www.runcms.org/public/modules/newbb_plus/viewtopic.php?topic_id=3493&forum=16
>
> Vendor Response
> ===============
> 30th March 2005 - Developer contacted through private msg
> 30th March 2005 - Developer reply for testing result
> 31st March 2005 - Developer announce to user to disable avatar upload  
> setting
> 5th  April 2005 - Fix Available
>
>



-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
View attachment "runcms-11a.htm" of type "text/html" (1146 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/