bugtraq - Re: Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 16 Jan 2007 13:07:06 -0500
From: Chris Kelly <ckdake@...ake.com>
To: me you <r.5.7@...mail.com>
Cc: submit@...w0rm.com, bugtraq@...urityfocus.com,
	security@...lery.menalto.com
Subject: Re: Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include Vulnerability

Gallery 1.4.4-pl4 and all versions of Gallery 1 more recent than this  
(I didn't check older versions as they are over 2 years old) are  
actually not vulnerable to this.  The actual code in contrib/phpBB2/ 
modules.php is:

    42   	$phpbb_root_path = "./";
    43 	// connect to phpbb
    44 	include_once($phpbb_root_path . 'extension.inc');
    45 	include_once($phpbb_root_path . 'common.'.$phpEx);
    46 	include_once($phpbb_root_path . 'includes/functions.'.$phpEx);

which defines phpbb_root_path first. Overwriting this through a get  
parameter would do no good because of line 42, and by default Gallery  
1 refuses to install if register_globals is enabled which should  
prevent the reported problem even if line 42 is not included.

Source code for reference:

1.4.4-pl4:
http://gallery.svn.sourceforge.net/viewvc/gallery/tags/ 
RELEASE_1_4_4_PL4/gallery/contrib/phpBB2/modules.php?view=markup

Current 1.5 branch (most up to date Gallery 1.5 versions, current  
stable version)
http://gallery.svn.sourceforge.net/viewvc/gallery/branches/ 
BRANCH_1_5_LEGACY/gallery/contrib/phpBB2/modules.php?view=markup

SVN turnk (current development, current 1.6-alpha3 and future release  
candidates)
http://gallery.svn.sourceforge.net/viewvc/gallery/trunk/gallery/ 
contrib/phpBB2/modules.php?view=markup


-Chris
Gallery Project Manager

--
Chris Kelly
ckdake@...ake.com
http://ckdake.com/


On Jan 16, 2007, at 8:52 AM, me you wrote:

> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
> Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include  
> Vulnerability
>
> Script : Gallery
>
> Version : 1.4.4-pl4
>
> URL : http://puzzle.dl.sourceforge.net/sourceforge/gallery/ 
> gallery-1.6-alpha3.tar.gz
>
> Author : BorN To K!LL
>
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
> Code in :.    contrib/phpBB2/modules.php
>
> 	include_once($phpbb_root_path . 'extension.inc');
> 	include_once($phpbb_root_path . 'common.'.$phpEx);
> 	include_once($phpbb_root_path . 'includes/functions.'.$phpEx);
>
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
> Explo!t :.
> ^^^^^
> www.site.com/[path]/contrib/phpBB2/modules.php? 
> phpbb_root_path=shellcode.txt?
>
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
> GreeTz to :  Dr.2  ,  Asbmay  ,  General C  ,  ToOoFa  ,   
> SHiKaA  ,  str0ke ...
>
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
> _________________________________________________________________
> Don't just search. Find. Check out the new MSN Search! http:// 
> search.msn.click-url.com/go/onm00200636ave/direct/01/
>