Date: 15 Apr 2005 20:38:56 -0000
From: Francisco Alisson <dominusvis@click21.com.br.>
To: bugtraq@securityfocus.com
Subject: Mafia Blog
X-Virus-Scanned: antivirus-gw at tyumen.ru
########################################################
#
# Mafia Blog
# Version: .4 BETA
# Vendor: http://chrisnowak.org/projects/mafia/
# Author: Chris Nowak
#
########################################################
Let's go... There's no check on admin folder so, anyone could get admin access just accessing admin folder.
As admin we can edit comments, upload images, Edit info about pictures and edit info about the configuration of the blog.
I think there's a possibility to a code injection editing the config of the blog:
The editinfo.php send the $_POST vars to writeinfo.php ->
... <form action="writeinfo.php" method="POST" name="takeinfo"> ...
(Code from editinfo.php)
So the "writeinfo.php" write (without no check) the info on "info.php" ->
... $handle = fopen("../info.php", "w");
fwrite($handle, "<?php\n\n");
fwrite($handle, "\$url = \"" . $_POST['url'] . "\";\n"); ...
(Code from writeinfo.php)
So, I think we send a special post to writeinfo.php it's possible to do a code injection writing something like "system($cmd);" on info.php or am I going wrong?
Sorry for bad english I'm just trying do learn ;)
Dominus_Vis
[Infektion Group]
Brazil
