Bugtraq mailing list archives
Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion
From: "Carsten Eilers" <ceilers-lists () gmx de>
Date: Sat, 2 Sep 2006 02:00:53 +0200
Hi, amir.scorpino () yahoo com schrieb am Tue, 29 Aug 2006 16:41:12 +0000:
+ModuleBased CMS(MBCMS) multiple remote file Inclusion +discripton:MBCMS (ModuleBased CMS) is a new CMS designed for ease of use and customability. It is designed +for PHP/MySQL and it is easy to write new modules or templates to suit a particular website. +version:alfa 1 +vendor site:http://sourceforge.net/projects/mbcms/
[...]
/admin/avatar.php <?php include_once($_SERVER[DOCUMENT_ROOT]."/libs/profile.class.php"); include($_SERVER[DOCUMENT_ROOT]."/libs/config.php");
[...] All of this could work. If (and only if) _SERVER[DOCUMENT_ROOT] can be manipulated through GET- or POST-parameters. Is this possible? <http://www.php.net/manual/en/reserved.variables.php> states "$_SERVER is an array containing information such as headers, paths, and script locations. The entries in this array are created by the webserver." and especially for DOCUMENT_ROOT: "'DOCUMENT_ROOT' The document root directory under which the current script is executing, as defined in the server's configuration file." I made some tests (Apache with several combinations of register_globals-settings etc.), and every time the $_SERVER[DOCUMENT_ROOT] was set from the Apache- configuration. Since I have no IIS for tests at the moment I can say nothing about the behavior there. But even if a manipulation is possible with IIS I would tend to see the vulnerability in IIS and not in PHP or the scripts. If there is no way to change $_SERVER[DOCUMENT_ROOT], then there are no vulnerabilities in MBCMS. Otherwise I bet we will see much more RFI-vulnerabilities due unchecked $_SERVER[DOCUMENT_ROOT] in include()- and require()-statements in the future, since the usage of this variable is a common way to create portable scripts. Regards Carsten -- Dipl.-Inform. Carsten Eilers IT-Sicherheit und Datenschutz <http://www.ceilers-it.de>
Current thread:
- Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion Carsten Eilers (Sep 02)