bugtraq - Mafia Blog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050415203856.26392.qmail@www.securityfocus.com>
Date: 15 Apr 2005 20:38:56 -0000
From: Francisco Alisson <dominusvis@...ck21.com.br>
To: bugtraq@...urityfocus.com
Subject: Mafia Blog

########################################################
#
# Mafia Blog
# Version: .4 BETA
# Vendor: http://chrisnowak.org/projects/mafia/
# Author: Chris Nowak 
#
########################################################

 Let's go... There's no check on admin folder so, anyone could get admin access just accessing admin folder.
 As admin we can edit comments, upload images, Edit info about pictures and edit info about the configuration of the blog.
 I think there's a possibility to a code injection editing the config of the blog:

 The editinfo.php send the $_POST vars to writeinfo.php ->

 ... <form action="writeinfo.php" method="POST" name="takeinfo"> ...
 (Code from editinfo.php)

 So the "writeinfo.php" write (without no check) the info on "info.php" ->
 ... $handle = fopen("../info.php", "w");
     fwrite($handle, "<?php\n\n");
     fwrite($handle, "\$url = \"" . $_POST['url'] . "\";\n"); ...
 (Code from writeinfo.php)

 So, I think we send a special post to writeinfo.php it's possible to do a code injection writing something like "system($cmd);" on info.php or am I going wrong?

 Sorry for bad english I'm just trying do learn ;)

    Dominus_Vis
 [Infektion Group]
      Brazil