full-disclosure - runcms/e-xoops 1.1A and below file upload vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed Apr  6 19:18:25 2005
From: pokleyzz at scan-associates.net (pokley)
Subject: runcms/e-xoops 1.1A and below file upload
	vulnerability

Products: runcms/e-xoops 1.1A (http://www.runcms.org)

Summary:  runcms/e-xoops 1.1A and below file upload vulnerability

Description
===========
runcms/e-xoops is an extensible, OO (Object Oriented), easy to use dynamic  
web content management system
written in PHP. runcms/e-xoops is the ideal tool for developing small to  
large dynamic community websites,
  intra company portals, corporate portals, weblogs and much more.

Details
=======
User may upload any file through file upload function .Example thought  
avatar upload when  "Allow custom
avatar upload" is set to "Yes" in "Custom avatar settings". This setting  
is not on by default installation.
This is cause of fileupload class will recursively save any file suppied  
by user in upload function.

-- upload file.php line 240

if ( !empty($HTTP_POST_FILES) ) {
	foreach ($HTTP_POST_FILES as $filename => $value) {

Fix
===
Fix available from runcms/e-xoops forum.
http://www.runcms.org/public/modules/newbb_plus/viewtopic.php?topic_id=3493&forum=16

Vendor Response
===============
30th March 2005 - Developer contacted through private msg
30th March 2005 - Developer reply for testing result
31st March 2005 - Developer announce to user to disable avatar upload  
setting
5th  April 2005 - Fix Available