 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 75
 Members: 0
 Total: 75
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Vulnerability in phpBB3? (watch the posted code pls) |
|
 Posted: Fri Nov 07, 2008 2:55 pm |
 |
|
| _mranderson_ |
| Valuable expert |
 |
|
| Joined: Oct 30, 2008 |
| Posts: 51 |
|
|
|
 |
|
 |
|
I downloaded phpBB3 from http://www.phpbb.com/
to have a look at the code.
This code is from /download/file.php inside the phpbb root directory:
| Code: | define('IN_PHPBB', true);
$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
if (isset($_GET['avatar']))
{
require($phpbb_root_path . 'config.' . $phpEx);
require($phpbb_root_path . 'includes/acm/acm_' . $acm_type . '.' . $phpEx);
require($phpbb_root_path . 'includes/cache.' . $phpEx);
require($phpbb_root_path . 'includes/db/' . $dbms . '.' . $phpEx);
require($phpbb_root_path . 'includes/constants.' . $phpEx); |
now let's see phpbbrootpath is defined, phpex is defined, but what about $acm_type? and what about $dbms?
now, I think $dbms is usually deifned in config.php (which is included first) so no LFI is possible, but what about $acm_type?
I tried to call /download/file.php?avatar=dummy&acm_type=%00 and I got 500 internal server error as response... hum... do you guys think LFI is possible? also when I tried dbms=../../index I got a white page...
tell me your opinion... |
|
|
|
|
|
|
|
|
| Posted: Fri Nov 07, 2008 6:26 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
You missed "config.php":
| Code: |
<?php
// phpBB 3.0.x auto-generated configuration file
// Do not change anything in this file!
$dbms = 'mysqli';
$dbhost = 'localhost';
$dbport = '';
$dbname = 'phpbb302';
$dbuser = '****';
$dbpasswd = '****';
$table_prefix = 'phpbb_';
$acm_type = 'file';
$load_extensions = '';
@define('PHPBB_INSTALLED', true);
// @define('DEBUG', true);
// @define('DEBUG_EXTRA', true);
?>
|
So these variables are allready defined. And by the way - here is same code from phpbb 3.0.2:
| Code: |
define('IN_PHPBB', true);
$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
if (isset($_GET['avatar']))
{
require($phpbb_root_path . 'config.' . $phpEx);
if (!defined('PHPBB_INSTALLED') || empty($dbms) || empty($acm_type))
{
exit;
}
require($phpbb_root_path . 'includes/acm/acm_' . $acm_type . '.' . $phpEx);
require($phpbb_root_path . 'includes/cache.' . $phpEx);
require($phpbb_root_path . 'includes/db/' . $dbms . '.' . $phpEx);
require($phpbb_root_path . 'includes/constants.' . $phpEx);
|
It seems to me, that developers have been extra cautions about possible LFI.
And finally - as for this moment, "register_globals=on" is rare thing to see in real world servers  |
|
|
|
|
|
|
|
|
| Posted: Fri Nov 07, 2008 7:03 pm |
|
|
| _mranderson_ |
| Valuable expert |
|
|
| Joined: Oct 30, 2008 |
| Posts: 51 |
|
|
|
|
|
|
|
Oh well, exactly as I expected...  |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
