bugtraq - Re: Re: # MHG Security Team --- PHP NUKE All version Remote File Inc.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200606022023.k52KNeoB024036@cairo.mitre.org>
Date: Fri, 2 Jun 2006 16:23:40 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: Re: # MHG Security Team --- PHP NUKE All version Remote File Inc.

>include("../../../mainfile.php");
>
>include($phpbb_root_path.'common.'.$phpEx);
>
>...
>
>in mainfile.php at lines 54-56
>
>...
>
>import_request_variables('GPC');

Oh, OK - now that makes sense.  This looks like one aspect of the
"globals overwrite" problem as originally documented by Stefan Esser
in the article "$GLOBALS Overwrite and it's Consequences"

  http://www.hardened-php.net/index.76.html

The article mentions extract() as well, and the behavior differs
between PHP4 and PHP5.

With respect to variables that seem to be cleansed - I've seen this
odd behavior once or twice before, but I don't remember the specifics
and can't dig up the Bugtraq post :-(

- Steve