note 110139 deleted from security.filesystem by aharvey
| From: | aharvey@php.net | Date: | Mon, 24 Sep 2012 01:31:11 +0000 |
| Subject: | note 110139 deleted from security.filesystem by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-190983@lists.php.net to get a copy of this message | ||
Note Submitter: lehal2 at hotmail dot com
----
function WhitePage($page) {
$info2 = apache_lookup_uri('src/index.php?p=' . $page);
list($arg, $val) = explode("=", $info2->args);
$myrequest = basename(htmlspecialchars_decode($val));
return $myrequest;
}
function Read_Dir($dir, $array = array()) {
$dh = opendir($dir);
$files = array();
while (($file = readdir($dh)) !== false) {
$flag = false;
if ($file !== '.' && $file !== '..' && !in_array($file,
$array)) {
$files[] = trim($file);
}
}
return $files;
}
function WhiteList($page = null) {
$info2 = apache_lookup_uri('src/index.php?p=' . $page);
list($arg, $val) = explode("=", $info2->args);
// basename from the std class
$myrequest = basename(htmlspecialchars_decode($val));
$myrequest = trim($myrequest . '.php');
//pathinfo from the std class
$path = pathinfo($info2->filename);
// get the files array
$whitefiles = Read_Dir($path['dirname']);
if (in_array($myrequest, $whitefiles, true)) {
$res = 1;
} else {
$res = 0;
}
return $res;
}
// this is solution of this kind of the problems
//$p='index.php?p=../../../../../../../../etc/passwd%00index.html';
$p = '../../../../../../../../etc/passwd%00index.html';
$p = WhitePage($p);
$result = WhiteList($p);
if ($result) {
echo 'ok';
} else {
echo 'hack attempt';
}