Re: Re: [RFC] No PHP tags
Hi Lester,
On Wed, Feb 12, 2014 at 2:56 PM, Lester Caine <lester@lsces.co.uk> wrote:
> Lester Caine wrote:
>
>> can you really protect them anyway?
>>
> Yasuo
> Have you actually looked at the 'Some recent LFI issues' that are listed?
> I don't thing any one of them would have been protected from by this
> change? Providing a php page that can DISPLAY or run any file that it can
> read is not going to be protected from by switching embedding off?
1st one is file upload vulnerability. I'll replace it something else.
2nd one is
http://seclists.org/bugtraq/2012/Apr/53
$filepath = "$path_to_citrus/$load.php";
if (file_exists($filepath)) {
include('./'.$load.'.php');
I'm not sure what they are loading. script() prevents from reading
/etc/passwd or any other files.
3rd one is
https://localhost/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00
It could also be protected by script().
4th one is
http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd
The same as 3rd one.
It works well for LFI. Important thing is include()/require() needs extra
care to make sure it's secure. I would suggest to validate all inputs, but
user may have invalid validation. Single mistake could be serious
disaster. It's better if there is script() for sure. (Defense in depth)
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net
Thread (37 messages)