Hi, [EMAIL PROTECTED] schrieb am Tue, 29 Aug 2006 16:41:12 +0000:
>+ModuleBased CMS(MBCMS) multiple remote file Inclusion > >+discripton:MBCMS (ModuleBased CMS) is a new CMS designed for ease of use >and customability. It is designed +for PHP/MySQL and it is easy to write >new modules or templates to suit a particular website. > >+version:alfa 1 > >+vendor site:http://sourceforge.net/projects/mbcms/ [...] >/admin/avatar.php > ><?php > >include_once($_SERVER[DOCUMENT_ROOT]."/libs/profile.class.php"); > >include($_SERVER[DOCUMENT_ROOT]."/libs/config.php"); > [...] All of this could work. If (and only if) _SERVER[DOCUMENT_ROOT] can be manipulated through GET- or POST-parameters. Is this possible? <http://www.php.net/manual/en/reserved.variables.php> states "$_SERVER is an array containing information such as headers, paths, and script locations. The entries in this array are created by the webserver." and especially for DOCUMENT_ROOT: "'DOCUMENT_ROOT' The document root directory under which the current script is executing, as defined in the server's configuration file." I made some tests (Apache with several combinations of register_globals-settings etc.), and every time the $_SERVER[DOCUMENT_ROOT] was set from the Apache- configuration. Since I have no IIS for tests at the moment I can say nothing about the behavior there. But even if a manipulation is possible with IIS I would tend to see the vulnerability in IIS and not in PHP or the scripts. If there is no way to change $_SERVER[DOCUMENT_ROOT], then there are no vulnerabilities in MBCMS. Otherwise I bet we will see much more RFI-vulnerabilities due unchecked $_SERVER[DOCUMENT_ROOT] in include()- and require()-statements in the future, since the usage of this variable is a common way to create portable scripts. Regards Carsten -- Dipl.-Inform. Carsten Eilers IT-Sicherheit und Datenschutz <http://www.ceilers-it.de>
