bugtraq - SimplePHPBlog Arbitrary File Deletion and Sample Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 28 Aug 2005 22:10:07 -0400
From: "'ken'@FTU" <ken@...security.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: SimplePHPBlog Arbitrary File Deletion and Sample Exploit

SimplePHPBlog has a vulnerability in its comment_delete_cgi.php.

The PHP script allows for the arbitrary deletion of files.

Attached is an perl script to demonstrate the exploit.

This vulnerability, in combination with the fact that the installation 
scripts are left on the server after installation, allows an arbitrary 
user to reset the admin password to one of the attacker's choosing.

The script demonstrates the ability to delete files, reset the admin 
password to the attacker's choosing and upload files (including a 
command prompt).

The exploit is for educational purposes only.

To prevent this exploit change the line in comment_delete_cgi.php
from $logged_in = logged_in( false, true );
to $logged_in = logged_in( true, true );

Sincerely,
'ken'@FTU
Kenneth F. Belva, CISSP
http://www.ftusecurity.com

View attachment "sphpblog_vulns.pl" of type "text/plain" (13229 bytes)