full-disclosure - phpSysInfo arbitrary file identification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060705101344.62991.qmail@web27909.mail.ukl.yahoo.com>
Date: Wed Jul  5 11:13:50 2006
From: wh1t3h4t3 at yahoo.co.uk (Micheal Turner)
Subject: phpSysInfo arbitrary file identification

phpSysInfo is a popular webscript for displaying stats
about a webserver available from
http://phpsysinfo.sourceforge.net/ with 365012
downloads to date. A vulnerability which allows an
attacker to identify if a file exists on the remote
system has been identified. By supplying a directory
traversal string to lng= in a POST or  GET request to
index.php with a poison null byte terminating %00
allows an attacker to determine if any file exists.
The vulnerable function is shown.

  if (!file_exists(APP_ROOT . '/includes/lang/' . $lng
. '.php')) {

An attacker can determine if the file exists by
studying the returned error message, valid files
return the string ?Sorry, we don't support this
language.? and invalid files return the normal
phpSysInfo application page. 

Example.
www.somesite.com/phpSysInfo/index.php?template=blue&lng=../../../../../../../../../../../var/log/httpd-error.log%00

Humour.
http://www.google.co.uk/search?hl=en&safe=off&client=firefox-a&rls=org.mozilla%3Aen-GB%3Aofficial&q=%22System+Information%22+phpSysInfo+site%3A.edu&btnG=Search&meta=

___________________________________________________________ 
Inbox full of spam? Get leading spam protection and 1GB storage with All New Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html