Home page logo
/

bugtraq logo Bugtraq mailing list archives

re: II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version)
From: "Frog Man" <leseulfrog () hotmail com>
Date: Sun, 11 May 2003 01:51:20 +0200

A message has been published on BugTraq by DownBload (http://www.securityfocus.com/archive/1/320997/2003-05-07/2003-05-13/0) about an include vulnerabilty in Yabb SE 1.5.2 (the last version).

This solution :
-----------------------------------------------------------------------------------------------

======[ Solution

Add this line before include_once() lines mentioned above.

----cut here----
if (!isset($sourcedir)) $sourcedir = "";
----cut here----

-----------------------------------------------------------------------------------------------
doesn't change anything for the security.
A good solution could be :

--------------------------------------------------------------
if (file_exists($sourcedir.'/Errors.php')){
include_once ($sourcedir . '/Errors.php');
include_once ($sourcedir . '/Subs.php');
include_once ($sourcedir . '/Load.php');
}else{
die("Bad path.");
}
--------------------------------------------------------------


A patch will be (I hope :)) soon downloadable on http://www.phpsecure.info
The author of this message, a friend, has been alerted.

frog-m () n

_________________________________________________________________



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]