full-disclosure - Re: runcms/e-xoops 1.1A and below file upload vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <opsouiql0ssmddlu@sampah>
Date: Thu Apr  7 14:42:17 2005
From: pokleyzz at scan-associates.net (pokley)
Subject: Re: runcms/e-xoops 1.1A and below file upload
	vulnerability

Proof of concept

On Wed, 06 Apr 2005 14:53:18 +0800, pokley <pokleyzz@...n-associates.net>  
wrote:

> Products: runcms/e-xoops 1.1A (http://www.runcms.org)
>
> Summary:  runcms/e-xoops 1.1A and below file upload vulnerability
>
> Description
> ===========
> runcms/e-xoops is an extensible, OO (Object Oriented), easy to use  
> dynamic web content management system
> written in PHP. runcms/e-xoops is the ideal tool for developing small to  
> large dynamic community websites,
>   intra company portals, corporate portals, weblogs and much more.
>
> Details
> =======
> User may upload any file through file upload function .Example thought  
> avatar upload when  "Allow custom
> avatar upload" is set to "Yes" in "Custom avatar settings". This setting  
> is not on by default installation.
> This is cause of fileupload class will recursively save any file suppied  
> by user in upload function.
>
> -- upload file.php line 240
>
> if ( !empty($HTTP_POST_FILES) ) {
> 	foreach ($HTTP_POST_FILES as $filename => $value) {
>
>
> Fix
> ===
> Fix available from runcms/e-xoops forum.
> http://www.runcms.org/public/modules/newbb_plus/viewtopic.php?topic_id=3493&forum=16
>
> Vendor Response
> ===============
> 30th March 2005 - Developer contacted through private msg
> 30th March 2005 - Developer reply for testing result
> 31st March 2005 - Developer announce to user to disable avatar upload  
> setting
> 5th  April 2005 - Fix Available
>
>



-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050407/de339921/runcms-11a.htm