Re: Xoop

["Vlad" <recompiler () hacksrus com>]

Hello,
 Yes I have already went after OS specific stuff etc. I was hoping
someone knew a way to pull up personal info for registered users on the
site or anything that would severely violate privacy policy etc.

As for OSVBD, I completely forgot, thank you
I already had everything I need but this is icing on the cake :-)
http://osvdb.org/displayvuln.php?osvdb_id=20853

Now for some quality report writing time...

Vlad G.

Josh Zlatin-Amishav wrote:
On
Wed, 30 Aug 2006, Vlad wrote:


  Hello,

I am pen testing a site and I found that it is running Apache/2.0.52

(Unix) mod_ssl/2.0.52 OpenSSL/0.9.7g PHP/5.0.4 mod_jk2/2.0.2  and

Xoop(don't know what version yet) among other things. The core of the

functionality I am testing is related to Xoop.


I searched for bugs and all the other basic stuff.


I noticed something interesting:

https://www.AAAAAAAAAA.com/main/modules/mymenu/index.php?file=index.php

so I tried

https://www.AAAAAAAAAA.com/main/modules/mymenu/index.php?file=../../

And I get a 404 file not found instead of 403!

With the exception of a few default apache DIRs listing is disabled but

all I need is to navigate to a useful/interesting file.


Anyone have any tips about Xoop?



Hi Vlad,

This is not Xoop specific, but do you have any indication if PHP's

open_basedir is enabled? In other words, have you tried requesting OS

related files? Another approach might be to try a remote file
inclusion,

(as long as allow_url_fopen has not been disabled) this way you could create

a local shell. Of course if your looking for Xoops specific issues there

are always these:

http://osvdb.org/searchdb.php?action=search_title&vuln_title=xoops&Search=Search


--

 - Josh





--

Vlad G.


The information transmitted is intended only for the person or entity to

which it is addressed and may contain confidential and/or privileged

material.

Any review, retransmission, dissemination or other use of, or taking of

any action in reliance upon, this information by persons or entities other

than the intended recipient is prohibited.

If you received this in error, please contact the sender and delete the

material from any computer.




!DSPAM:25,44f6951e214201459317085!