注册
登录
| 关键词： nbsp Vulnerability abysssec PHP SafeMod windows directory com www 5.2 |
#SuperHei:关于 PHP <= 5.2.9 SafeMod Bypass Vulnerability [by www.abysssec.com]http://www.milw0rm.com/exploits/8799 这个问题的分析,很详细 Abysssec Inc Public Advisory Title : PHP <= 5.2.9 SafeMod Bypass VulnerabilityAffected Version : Tested on 5.2.8, 5.2.6 but previous versions maybe be afftectVendor Site : www.php.net Vulnerability Discoverd by : www.abysssec.com Description : Here is another safemod bypass vulnerability exist in php <= 5.2.9 on windows .the problem comes from OS behavior - implement and interfacing between phpand operation systems directory structure . the problem is php won't tell differencebetween directory browsing in linux and windows this can lead attacker to abilityexecute his / her commands on targert machie even in SafeMod On (php.ini setting) . Vulnerability : in linux when you want open a directory for example php directory you needto go to /usr/bin/php and you can't use \usr\bin\php . but windows won't telldiffence between slash and back slash it means there is no didffrence betweenc:\php and c:/php , and this is not vulnerability but itself but because of this simplephp implement "\" character can escape safemode using function like excec . PoC / Exploit : orginal : www.abysssec.com/safemod-windows.zipmirror : www.milw0rm.com/sploits/2009-safemod-windows.zip note : this vulnerabities is just for educational purpose and showing vulnerability existso author will be not be responsible for any damage using this vulnerabilty. for more information visit Abysssec.comfeel free to contact me at admin [at] abysssec.com # milw0rm.com [2009-05-26] |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
