bugtraq - Re: Vanilla CMS <= 1.0.1 (RootDirectory) Remote file inclusion Vuln.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060805110713.21280.qmail@securityfocus.com>
Date: 5 Aug 2006 11:07:13 -0000
From: dinoboff@...mail.com
To: bugtraq@...urityfocus.com
Subject: Re: Vanilla CMS <= 1.0.1 (RootDirectory) Remote file inclusion Vuln.

>From Mark O'Sullivan, on http://lussumo.com/community/:
"Here is the code in question:

$WorkingDirectory = str_replace('\\', '/', getcwd()).'/';
$RootDirectory = str_replace('setup/', '', $WorkingDirectory);

// ...

// Include the old settings file if it is present (it just contains constants)
if (file_exists($RootDirectory.'conf/old_settings.php')) {
include($RootDirectory.'conf/old_settings.php');

As you can see, there is NO vulnerability. The variable used in the path is defined a few lines above the code from the original report, and is defined using PHP's getcwd(); function. There is absolutely NO user-input that could cause the vulnerability suggested, and the "proof of concept" provided cannot possibly work."