full-disclosure - cryptographp v1.4: file contents disclosure bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c9a09d00903150656j74d5e76fkfa69b343c3f4a8ec@mail.gmail.com>
Date: Sun, 15 Mar 2009 14:56:16 +0100
From: "Jan G.B." <ro0ot.w00t@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: cryptographp v1.4: file contents disclosure bug

Cryptographp - a `free` captcha script

I contacted the author on 2009-02-11 via e-mail but I did not get a response.
I feel the need users of that script should be aware of such a bug.

The main include of that script has the following PHP code:

#####
if (is_file($_GET['cfg']) and dirname($_GET['cfg'])=='.' )
$_SESSION['configfile']=$_GET['cfg'];
  else  $_SESSION['configfile']="cryptographp.cfg.php";

include($_SESSION['configfile']):
#####

This enables an attacker to output any file in the current directory,
where cryptographp has been installed.
For example you can read .ht* files like .htpasswd, .htaccess

Vulnerable: Latest Version 1.4 (did not check below)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/