Re: runcms/e-xoops 1.1A and below file upload vulnerability

[pokley <pokleyzz () scan-associates net>]

Proof of concept

On Wed, 06 Apr 2005 14:53:18 +0800, pokley <pokleyzz () scan-associates net>  
wrote:

> Products: runcms/e-xoops 1.1A (http://www.runcms.org)
>
> Summary:  runcms/e-xoops 1.1A and below file upload vulnerability
>
> Description
> ===========
> runcms/e-xoops is an extensible, OO (Object Oriented), easy to use  
> dynamic web content management system
> written in PHP. runcms/e-xoops is the ideal tool for developing small to  
> large dynamic community websites,
>   intra company portals, corporate portals, weblogs and much more.
>
> Details
> =======
> User may upload any file through file upload function .Example thought  
> avatar upload when  "Allow custom
> avatar upload" is set to "Yes" in "Custom avatar settings". This setting  
> is not on by default installation.
> This is cause of fileupload class will recursively save any file suppied  
> by user in upload function.
>
> -- upload file.php line 240
>
> if ( !empty($HTTP_POST_FILES) ) {
>         foreach ($HTTP_POST_FILES as $filename => $value) {
>
>
> Fix
> ===
> Fix available from runcms/e-xoops forum.
> http://www.runcms.org/public/modules/newbb_plus/viewtopic.php?topic_id=3493&forum=16
>
> Vendor Response
> ===============
> 30th March 2005 - Developer contacted through private msg
> 30th March 2005 - Developer reply for testing result
> 31st March 2005 - Developer announce to user to disable avatar upload  
> setting
> 5th  April 2005 - Fix Available



--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/