Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Mambo Component - EstateAgent Remote File Inclusion

from [Carsten Eilers] Network Security [Permanent Link]
Subject: Re: Mambo Component - EstateAgent Remote File Inclusion
Date: Thu, 24 Aug 2006 00:51:34 +0200 
Hi,

Outlaw@aria-security.net schrieb am Sun, 20 Aug 2006 02:02:16 +0000:

Ay you wrote yourself:


# Don't allow direct linking

 defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not
allowed.' );


This kills the script I you try a direct access, so there
is no manipulation of variables possible.
                                                                                
          


#Proof of Concept:                                                             
         

#

#www.site.com/com_estateagent/estateagent.php?mosConfig_absolute_path=shell


Dies imediately without any code-execution after the
defined-line above.
    


#Solutions : 

#1 - If you have access on webserver turn register_globals in php.ini off

#2 - You must give a value before put the value of variable in the
include function or check and filter 


You forgot

#3 - Check variable in other script and let this script die
     after direct access.

Oh, #3 is always implemented... ;-)

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: PHlyMail Lite [PM_[path][lib]=] Remote File Include Vulnerability, Carsten Eilers
Next by Date:  Re: ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include, Carsten Eilers
Previous by Thread:  Mambo Component - EstateAgent Remote File Inclusion, Outlaw
Next by Thread:  ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include, h4ck3riran
Indexes:  [Date] [Thread] [Top] [All Lists]