Mafia Blog

[Francisco Alisson <dominusvis@xxxxxxxxxxxxxx>]

########################################################
#
# Mafia Blog
# Version: .4 BETA
# Vendor: http://chrisnowak.org/projects/mafia/
# Author: Chris Nowak 
#
########################################################

 Let's go... There's no check on admin folder so, anyone could get admin access 
just accessing admin folder.
 As admin we can edit comments, upload images, Edit info about pictures and 
edit info about the configuration of the blog.
 I think there's a possibility to a code injection editing the config of the 
blog:

 The editinfo.php send the $_POST vars to writeinfo.php ->
 
 ... <form action="writeinfo.php" method="POST" name="takeinfo"> ...
 (Code from editinfo.php)
 
 So the "writeinfo.php" write (without no check) the info on "info.php" ->
 ... $handle = fopen("../info.php", "w");
     fwrite($handle, "<?php\n\n");
     fwrite($handle, "\$url = \"" . $_POST['url'] . "\";\n"); ...
 (Code from writeinfo.php)

 So, I think we send a special post to writeinfo.php it's possible to do a code 
injection writing something like "system($cmd);" on info.php or am I going 
wrong?

 Sorry for bad english I'm just trying do learn ;)

    Dominus_Vis
 [Infektion Group]
      Brazil