bugtraq - PhpWebFTP 3.2 Login Script

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 17 Apr 2006 02:21:52 -0000
From: arko.dhar@...il.com
To: bugtraq@...urityfocus.com
Subject: PhpWebFTP 3.2    Login Script

Summary 
===============================================
phpWebFTP enables connections to FTP servers, even behind a firewall not allowing traffic. phpWebFTP bypasses the firewall by making a FTP connection from your webserver to the FTP server and transfering the files to your webclient over the http protocol

===========================================

Issue :
Well I have found that most of the sites that use phpwebftp v3.2 > less  have a problem. The user login script is a javascript file called script.js. This file validates the user input in the logon box. But to my surprise this file is directly accessed by web browser . The  disclosure of the source code can help an attacker to trigger    code injections .

Exploit :
http://www.anysite.com/PhpWebFtp/include/script.js

Further a directory traversal is possible via malicious arguments passed on the web browser using POST Method relative to the path of phpWebftp ie. http://www.anysite.com/PhpWebFtp/index.php? .

'server=1&port=21&goPassive=on&user=1&password=1&language=../../../../../../../../etc/passwd%00'