bugtraq - Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20060902000053.15771@mail.gmx.de>
Date: Sat, 2 Sep 2006 02:00:53 +0200
From: "Carsten Eilers" <ceilers-lists@....de>
To: <amir.scorpino@...oo.com>, <bugtraq@...urityfocus.com>
Subject: Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion

Hi,

amir.scorpino@...oo.com schrieb am Tue, 29 Aug 2006 16:41:12 +0000:

>+ModuleBased CMS(MBCMS) multiple remote file Inclusion
>
>+discripton:MBCMS (ModuleBased CMS) is a new CMS designed for ease of use
>and customability. It is designed +for PHP/MySQL and it is easy to write
>new modules or templates to suit a particular website. 
>
>+version:alfa 1
>
>+vendor site:http://sourceforge.net/projects/mbcms/

[...]

>/admin/avatar.php
>
><?php
>
>include_once($_SERVER[DOCUMENT_ROOT]."/libs/profile.class.php");
>
>include($_SERVER[DOCUMENT_ROOT]."/libs/config.php");
>
[...]

All of this could work. 
If (and only if) _SERVER[DOCUMENT_ROOT] can be manipulated 
through GET- or POST-parameters. 

Is this possible?

<http://www.php.net/manual/en/reserved.variables.php>
states
"$_SERVER is an array containing information  such as 
headers, paths, and script locations. The entries in this
array are created by the webserver."

and especially for DOCUMENT_ROOT:

"'DOCUMENT_ROOT'
    The document root directory under which the current 
    script is  executing, as defined in the server's 
    configuration file."

I made some tests (Apache with several combinations of
register_globals-settings etc.), and every time the 
$_SERVER[DOCUMENT_ROOT] was set from the Apache-
configuration. Since I have no IIS for tests at the
moment I can say nothing about the behavior there. But
even if a manipulation is possible with IIS I would tend
to see the vulnerability in IIS and not in PHP or the
scripts.

If there is no way to change $_SERVER[DOCUMENT_ROOT],
then there are no vulnerabilities in MBCMS.

Otherwise I bet we will see much more RFI-vulnerabilities
due unchecked $_SERVER[DOCUMENT_ROOT] in include()- and
require()-statements in the future, since the usage of 
this variable is a common way to create portable scripts.

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>