<![CDATA[Wolves Security Team - 4Images 1.7.6 Local Inclusion Vulnerability]]> http://bbs.wolvez.org/topic/56/ Tue, 17 Feb 2009 03:25:52 +0000 PunBB <![CDATA[Re: 4Images 1.7.6 Local Inclusion Vulnerability]]> http://bbs.wolvez.org/post/131/#p131 http://bbs.wolvez.org/topic/22/

]]> Tue, 17 Feb 2009 03:25:52 +0000 http://bbs.wolvez.org/post/131/#p131 <![CDATA[Re: 4Images 1.7.6 Local Inclusion Vulnerability]]> http://bbs.wolvez.org/post/130/#p130 toby57 wrote:

呃……就怕开了GPC...^_^


if (get_magic_quotes_gpc() == 0) { $HTTP_GET_VARS =addslashes_array($HTTP_GET_VARS); $HTTP_POST_VARS =addslashes_array($HTTP_POST_VARS); $HTTP_COOKIE_VARS =addslashes_array($HTTP_COOKIE_VARS); }

我犯了一个错误，sorry

这个貌似关了gpc也不能用%00截断 :)

不过可以用一个思路，比如在linux下，可以通过旁注拿个shell，然后写个main.php到/tmp目录下，然后包含之

]]> Tue, 17 Feb 2009 01:21:48 +0000 http://bbs.wolvez.org/post/130/#p130 <![CDATA[Re: 4Images 1.7.6 Local Inclusion Vulnerability]]> http://bbs.wolvez.org/post/128/#p128 嗯 还可以采用包含日志的方法...

]]> Sat, 14 Feb 2009 14:21:30 +0000 http://bbs.wolvez.org/post/128/#p128 <![CDATA[4Images 1.7.6 Local Inclusion Vulnerability]]> http://bbs.wolvez.org/post/127/#p127 4Images  1.7.6  Local Inclusion Vulnerability
BY Flyh4t
/***********************************************************/
4images - Image Gallery Management System  V1.7.6  Local Inclusion Vulnerability

Author :     Flyh4t
msn :     flyh4t@hotmail.com
team:     Wolves Security Team
site:        bbs.wolvez.org
Greet to : q1ur3n  puret_t  make0day  and all the members of Wolves Security Team
/***********************************************************/
Bug file : global.php
if (isset($HTTP_GET_VARS['l']) || isset($HTTP_POST_VARS['l'])) {
  $requested_l = (isset($HTTP_GET_VARS['l'])) ? trim($HTTP_GET_VARS['l']) : trim($HTTP_POST_VARS['l']);
  if ($requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {
    $l = $requested_l;
    $config['language_dir'] = $l;
  }
}

include_once(ROOT_PATH.'lang/'.$config['language_dir'].'/main.php');

/***********************************************************/
global.php is included by all the files of 4images,so it can be exploited through many files


/***********************************************************/

]]> Sat, 14 Feb 2009 14:17:36 +0000 http://bbs.wolvez.org/post/127/#p127