Bugtraq: Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion

["Carsten Eilers" <ceilers-lists () gmx de>]

Hi,

amir.scorpino () yahoo com schrieb am Tue, 29 Aug 2006 16:41:12 +0000:

> +ModuleBased CMS(MBCMS) multiple remote file Inclusion
>
> +discripton:MBCMS (ModuleBased CMS) is a new CMS designed for ease of use
> and customability. It is designed +for PHP/MySQL and it is easy to write
> new modules or templates to suit a particular website. 
>
> +version:alfa 1
>
> +vendor site:http://sourceforge.net/projects/mbcms/
[...]

> /admin/avatar.php
>
> <?php
>
> include_once($_SERVER[DOCUMENT_ROOT]."/libs/profile.class.php");
>
> include($_SERVER[DOCUMENT_ROOT]."/libs/config.php");
[...]

All of this could work. 
If (and only if) _SERVER[DOCUMENT_ROOT] can be manipulated 
through GET- or POST-parameters. 

Is this possible?

<http://www.php.net/manual/en/reserved.variables.php>
states
"$_SERVER is an array containing information  such as 
headers, paths, and script locations. The entries in this
array are created by the webserver."

and especially for DOCUMENT_ROOT:

"'DOCUMENT_ROOT'
    The document root directory under which the current 
    script is  executing, as defined in the server's 
    configuration file."

I made some tests (Apache with several combinations of
register_globals-settings etc.), and every time the 
$_SERVER[DOCUMENT_ROOT] was set from the Apache-
configuration. Since I have no IIS for tests at the
moment I can say nothing about the behavior there. But
even if a manipulation is possible with IIS I would tend
to see the vulnerability in IIS and not in PHP or the
scripts.


If there is no way to change $_SERVER[DOCUMENT_ROOT],
then there are no vulnerabilities in MBCMS.

Otherwise I bet we will see much more RFI-vulnerabilities
due unchecked $_SERVER[DOCUMENT_ROOT] in include()- and
require()-statements in the future, since the usage of 
this variable is a common way to create portable scripts.

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>