lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Jan 2013 11:54:51 -0300
From: WHK Yan <>
Subject: File Disclosure in SimpleMachines Forum <= 2.0.3

A security flaw allows an attacker to know the full source file of the web

Sources/ManageErrors.php Line 340:
// Make sure the file we are looking for is one they are allowed to look at
if (!is_readable($file) || (strpos($file, '../') !== false && (
strpos($file, $boarddir) === false || strpos($file, $sourcedir) === false)))
    fatal_lang_error('error_bad_file', true,

Bypass function strpos($file, '../'), no need "../", example:

Read /etc/passwd

works with path disclosure for read Settings.php:,2792.0.html

1. Open
2. Get full path of web app ( /home/1337/public_html/SSI.php ).
3. Exploit in base64:
To read /home/spadmin/public_html/Settings.php

Referer and Mirror:

Content of type "text/html" skipped

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists