Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: PHP :: b06-2786.htm

aWebNews <= 1.0 (login.php) Remote DocumentRoot file disclosure



aWebNews <= 1.0 (login.php) Remote DocumentRoot file disclosure
aWebNews <= 1.0 (login.php) Remote DocumentRoot file disclosure



*/ Federico Fazzi,  
*/ aWebNews <= 1.0 (login.php) Remote DocumentRoot file disclosure
*/ 04/06/2006 5:48

login.php: line 64-68,

Bug:

-- start --
if ($_GET['page'] == "") {
$pagetogo = "index.php";
} else {
$pagetogo = $_GET['page'];
}
-- end --

Proof of concept:

Open the browser and go at:

http://example.org/aWebNews/login.php?page=/aWebNews/[some file] 

now insert login and password and press enter.. now you can
read [some file] at documentroot master directory.

Patch:

--- login.php  2006-06-04 05:45:51.000000000 +0200
+++ login.php   2006-06-04 05:44:22.000000000 +0200
@@ -61,10 +61,8 @@
 }
 else
 {
-if ($_GET['page'] == "") {
+if ($_GET['page'] != 'index.php') {
 $pagetogo = "index.php";
-} else {
-$pagetogo = $_GET['page'];
 }
 ?>
       
Login

Your are logged in as:
Please Logout.
  */ end of file


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH