bugtraq - Re: phpMyConferences <= 8.0.2 Remote File Inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200611030200.kA320axr002587@faron.mitre.org>
Date: Thu, 2 Nov 2006 21:00:36 -0500 (EST)
From: "Steven M. Christey" <coley@...re.org>
To: mfp.c@...mail.com
Cc: bugtraq@...urityfocus.com
Subject: Re: phpMyConferences <= 8.0.2 Remote File Inclusion

mfp.c,

In 8.0.2, the surrounding code for this bug is:

  function insert_cached_module($module_desc)
  {
      ...
      global $lvc_modules_dir;
      ...
      if (!$gloaded_modules[$module_name])
          {
              include($lvc_modules_dir.'/'.$module_name.'.module.php');

Since this include is within a function definition, the claimed
exploit (direct request to library.inc.php) should not work.

I'm unclear on whether a global declaration for a variable within a
function definition is sufficient to override initialization from
things like GET requests, but at best, the direct request to
library.inc.php appears erroneous.

Were you able to get an exploit to work?

- Steve