Re: REMOTE FILE INCLUSION ( ALL )

["Steven M. Christey" <coley () mitre org>]

This post appears to have some errors.

What PHP version, environment, and operating system did you use to
test this?  Did you use a real web site, or did you just look at the
source code?

When a variable is used in a require or include statement, you must
make sure that the variable can be controlled by an attacker.  If the
variable is set to a fixed value, or it can only be changed by the
administrator, then it probably is not a vulnerability.

> CzarNews v1.14 Version - Remote File Include Vulnerabilities
>
> Link : http://www.root-security.org/danger/CzarNews.txt

If you search google.com for "CzarNews," then the 4th item is a
Secunia advisory for exactly the same vulnerability, which is
attributed to brOmstar and first announced sometime in March 2005.
That was not mentioned here.

> Simpnews <= All version - Remote File Include Vulnerabilities
>
> Link : http://www.root-security.org/danger/Simpnews.txt

It will be interesting to see the answer to str0ke's question about
this problem, since the source code suggests that there is no
vulnerability.

> phphg Guestbook Signed.PHP - Remote File Include Vulnerabilities
>
> Link : http://www.root-security.org/danger/phphgGuestbook.txt

The original source code as quoted from this advisory says:

> # $phphg_real_path = "./";
> # include($phphg_real_path . 'common.php');

which doesn't seem exploitable as presented, since $phphg_real_path is
set to a static value that is not controlled by an attacker.

> Flog 1.1.2 Version - Remote File Include Vulnerabilities
>
> Link : http://www.root-security.org/danger/Flog.txt

this link gives the code example:

> # $FLog_dir_include = 'include/';
> ...
> require_once($FLog_dir_include.'core.inc.php');

and, again, the variable is set to a static value.

> wheatblog 1.0 Version - "wb_inc_dir" Parameter File Inclusion
> Vulnerability
>
> Link : http://www.root-security.org/danger/wheatblog.txt

which says:

> # require_once('./settings.php');
> ...
> # include_once("$wb_inc_dir/header.php");
> ...
> # http://www.victim.com/wheatblog/view_links.php?wb_inc_dir=Command-Shell

view_links.php does not define $wb_inc_dir, but if we look at
settings.php, we have:

>       $wb_dir =               '/www/wheatblog';  
>       $wb_inc_dir   = "$wb_dir/includes";

So, if the administrator sets $wb_dir to a fixed value, then
$wb_inc_dir cannot be controlled by an attacker.

> MD News 1 Version - Remote File Include Vulnerabilities
>
> Link : http://www.root-security.org/danger/MDNews.txt

the extracted code from this link says:

> # $configfile = "config.php";
> # require $configfile;

and gives a demonstration URL:

> # http://www.victim.com/MD News/latest.php?configfile=Command-Shell

but here, again, the variable is defined to a static value (this
particular source code can be seen from
http://scripts.ringsworld.com/news-publishing/mdnews/latest.php.html)


I did not examine the claims for the other products that were listed
in the original post.

- Steve