bugtraq - Re: Shoutpro 1.0 Version - Remote File Include Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200606132135.k5DLZcAc023847@faron.mitre.org>
Date: Tue, 13 Jun 2006 17:35:38 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: SpC-x@...mail.org
Cc: bugtraq@...urityfocus.com
Subject: Re: Shoutpro 1.0 Version - Remote File Include Vulnerability

# if ($path){
# $ips = file("$path/lists/bannedips.php");
# } else {
# $ips = file("lists/bannedips.php");
# }
# if (in_array($REMOTE_ADDR,$ips)) {
# echo($bannedmessage);
# die;

There might be a terminology problem here.

I don't see how this can be used to execute code.  Yes, the file()
call could be used to access a file that the attacker can control, but
the only use of the $ips array is in checking for banned addresses.
The use of file() is not the same as include() or require().

So - attackers could use this to bypass a ban against their IP address
because they can control the ban file, but that's not the same as
"inclusion."

- Steve