cryptographp v1.4: file contents disclosure bug

["Jan G.B." <ro0ot.w00t () googlemail com>]

Cryptographp - a `free` captcha script

I contacted the author on 2009-02-11 via e-mail but I did not get a response.
I feel the need users of that script should be aware of such a bug.

The main include of that script has the following PHP code:

#####
if (is_file($_GET['cfg']) and dirname($_GET['cfg'])=='.' )
$_SESSION['configfile']=$_GET['cfg'];
  else  $_SESSION['configfile']="cryptographp.cfg.php";

include($_SESSION['configfile']):
#####

This enables an attacker to output any file in the current directory,
where cryptographp has been installed.
For example you can read .ht* files like .htpasswd, .htaccess


Vulnerable: Latest Version 1.4 (did not check below)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/