Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:13421
HistoryJul 05, 2006 - 12:00 a.m.

[Full-disclosure] phpSysInfo arbitrary file identification

2006-07-0500:00:00
vulners.com
20

phpSysInfo is a popular webscript for displaying stats
about a webserver available from
http://phpsysinfo.sourceforge.net/ with 365012
downloads to date. A vulnerability which allows an
attacker to identify if a file exists on the remote
system has been identified. By supplying a directory
traversal string to lng= in a POST or GET request to
index.php with a poison null byte terminating %00
allows an attacker to determine if any file exists.
The vulnerable function is shown.

if (!file_exists(APP_ROOT . '/includes/lang/' . $lng
. '.php')) {

An attacker can determine if the file exists by
studying the returned error message, valid files
return the string “Sorry, we don't support this
language.” and invalid files return the normal
phpSysInfo application page.

Example.
www.somesite.com/phpSysInfo/index.php?template=blue&lng=…/…/…/…/…/…/…/…/…/…/…/var/log/httpd-error.log%00

Humour.
http://www.google.co.uk/search?hl=en&safe=off&client=firefox-a&rls=org.mozilla%3Aen-GB%3Aofficial&q=%22System+Information%22+phpSysInfo+site%3A.edu&btnG=Search&meta=


Inbox full of spam? Get leading spam protection and 1GB storage with All New Yahoo! Mail.
http://uk.docs.yahoo.com/nowyoucan.html


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/