Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion
Hi,
amir.scorpino@xxxxxxxxx schrieb am Tue, 29 Aug 2006 16:41:12 +0000:
>+ModuleBased CMS(MBCMS) multiple remote file Inclusion
>
>+discripton:MBCMS (ModuleBased CMS) is a new CMS designed for ease of use
>and customability. It is designed +for PHP/MySQL and it is easy to write
>new modules or templates to suit a particular website.
>
>+version:alfa 1
>
>+vendor site:http://sourceforge.net/projects/mbcms/
[...]
>/admin/avatar.php
>
><?php
>
>include_once($_SERVER[DOCUMENT_ROOT]."/libs/profile.class.php");
>
>include($_SERVER[DOCUMENT_ROOT]."/libs/config.php");
>
[...]
All of this could work.
If (and only if) _SERVER[DOCUMENT_ROOT] can be manipulated
through GET- or POST-parameters.
Is this possible?
<http://www.php.net/manual/en/reserved.variables.php>
states
"$_SERVER is an array containing information such as
headers, paths, and script locations. The entries in this
array are created by the webserver."
and especially for DOCUMENT_ROOT:
"'DOCUMENT_ROOT'
The document root directory under which the current
script is executing, as defined in the server's
configuration file."
I made some tests (Apache with several combinations of
register_globals-settings etc.), and every time the
$_SERVER[DOCUMENT_ROOT] was set from the Apache-
configuration. Since I have no IIS for tests at the
moment I can say nothing about the behavior there. But
even if a manipulation is possible with IIS I would tend
to see the vulnerability in IIS and not in PHP or the
scripts.
If there is no way to change $_SERVER[DOCUMENT_ROOT],
then there are no vulnerabilities in MBCMS.
Otherwise I bet we will see much more RFI-vulnerabilities
due unchecked $_SERVER[DOCUMENT_ROOT] in include()- and
require()-statements in the future, since the usage of
this variable is a common way to create portable scripts.
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>