CoolForum v 0.5 beta shows content of PHP files
CoolForum v 0.5 beta shows PHP content files
Discovered on 2002, September, 16th
Vendor: Cool Forum
CoolForum v 0.5 is a PHP forum. This forum can show content of PHP files.
This forum contains a file named "avatar.php". This file can show an image stored in the logos
directory. Here is the source file of avatar.php :<?header('Pragma: no-cache');
else if (ereg(".gif",$img))
What this file do ? It's simple : It takes the name of the file as argument, read it fully, and send back the content to your browser.
The security flaw is that any
file, in or out
the logos directory can be show, bypassing any protected directories...
The exploit is really easy. The aim is to read the connect.php
file in the secret
contains the informations about the database connection and secret
directory is protected by a .htaccess
file. You can do the exploit with any browser by using this syntax :http://<Forum_URL>avatar.php?img=../secret/connect.php
Of course, replace <Forum_URL> by the vulnerable server.
You will get this page :
If you edit the source of the web page, you'll get the jackpot...
The vendor has been informed and has solved the problem.Download CoolForum 0.5.1 or lastest
Arnaud Jacques aka scrap