bugtraq - Re: Simpnews <= All version - Remote File Include Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <814b9d50606131506g41fe72d7o6c25b3ec708fd595@mail.gmail.com>
Date: Tue, 13 Jun 2006 17:06:44 -0500
From: str0ke <str0ke@...w0rm.com>
To: "SpC-x@...mail.org" <SpC-x@...mail.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: Simpnews <= All version - Remote File Include Vulnerabilities


> # Simpnews <= All version - Remote File Include Vulnerabilities
> # require_once($path_simpnews.'/langchk.php');
> # include_once('./language/lang_'.$act_lang.'.php');
> # require_once('./includes/get_settings.inc');
> # require_once('./includes/wap_get_settings.inc');

> # Vulnerable :
> # http://www.victim.com/Simpnews/wap_short_news.php?path_simpnews=Command-Shell

Was this verified on a running site or was this just source inspected?
The below shouldn't be vulnerable with config.php declaring $path_simpnews.

CODE
--------------------------------------
require_once('./config.php');
require_once('./functions.php');
if(!isset($category))
	$category=0;
require_once($path_simpnews.'/langchk.php');
include_once('./language/lang_'.$act_lang.'.php');
require_once('./includes/get_settings.inc');
require_once('./includes/wap_get_settings.inc');

config.php
--------------------------------------
$path_simpnews = getenv("DOCUMENT_ROOT")."/simpnews";

/str0ke