[Full-disclosure] phpSysInfo arbitrary file identification

Type securityvulns
Reporter Securityvulns
Modified 2006-07-05T00:00:00


phpSysInfo is a popular webscript for displaying stats about a webserver available from http://phpsysinfo.sourceforge.net/ with 365012 downloads to date. A vulnerability which allows an attacker to identify if a file exists on the remote system has been identified. By supplying a directory traversal string to lng= in a POST or GET request to index.php with a poison null byte terminating %00 allows an attacker to determine if any file exists. The vulnerable function is shown.

if (!file_exists(APP_ROOT . '/includes/lang/' . $lng . '.php')) {

An attacker can determine if the file exists by studying the returned error message, valid files return the string “Sorry, we don't support this language.” and invalid files return the normal phpSysInfo application page.

Example. www.somesite.com/phpSysInfo/index.php?template=blue&lng=../../../../../../../../../../../var/log/httpd-error.log%00

Humour. http://www.google.co.uk/search?hl=en&safe=off&client=firefox-a&rls=org.mozilla%3Aen-GB%3Aofficial&q=%22System+Information%22+phpSysInfo+site%3A.edu&btnG=Search&meta=

Inbox full of spam? Get leading spam protection and 1GB storage with All New Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html

Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/