bugtraq - Re: myBloggie <= 2.1.3 (mybloggie_root_path) Remote File Inclusion Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 12 Aug 2006 15:54:09 -0000
From: nukedx@...edx.com
To: bugtraq@...urityfocus.com
Subject: Re: myBloggie <= 2.1.3 (mybloggie_root_path) Remote File
 Inclusion Vulnerability

Hi,
I checked these files you said vulnerable and could not see any vulnerability.
Lets check lines 25-34 of index.php:
--source code of index.php lines 25 to 34-
25: //error_reporting('E_ALL');
26:
27: define('IN_MYBLOGGIE', true);
28:
29: session_start();
30: header("Cache-control: private");
31: //error_reporting  (E_ERROR | E_WARNING | E_PARSE);
32: set_magic_quotes_runtime(0);     // changes for 2.1.3
33:
34: $mybloggie_root_path = './';
-- end of source --

And you said lines 190-192 of index.php is vulnerable.
--source code of index.php lines 190 to 192-
190: if (!isset($mode)) {
191:     include($mybloggie_root_path.'blog.php');
192: }
-- end of source --
As we can see variable mybloggie_root_path already set by index.php

We have same results in admin.php and db.php, Please dont post every include() function as a RFI vuln.
Dont post such a messages for being famous.
Regards,
Mustafa Can Bjorn IPEKCI