Gallery 1.4.4-pl4 and all versions of Gallery 1 more recent than this
(I didn't check older versions as they are over 2 years old) are
actually not vulnerable to this. The actual code in contrib/phpBB2/
modules.php is:
42 $phpbb_root_path = "./";
43 // connect to phpbb
44 include_once($phpbb_root_path . 'extension.inc');
45 include_once($phpbb_root_path . 'common.'.$phpEx);
46 include_once($phpbb_root_path . 'includes/functions.'.$phpEx);
which defines phpbb_root_path first. Overwriting this through a get
parameter would do no good because of line 42, and by default Gallery
1 refuses to install if register_globals is enabled which should
prevent the reported problem even if line 42 is not included.
Source code for reference:
1.4.4-pl4:
http://gallery.svn.sourceforge.net/viewvc/gallery/tags/
RELEASE_1_4_4_PL4/gallery/contrib/phpBB2/modules.php?view=markup
Current 1.5 branch (most up to date Gallery 1.5 versions, current
stable version)
http://gallery.svn.sourceforge.net/viewvc/gallery/branches/
BRANCH_1_5_LEGACY/gallery/contrib/phpBB2/modules.php?view=markup
SVN turnk (current development, current 1.6-alpha3 and future release
candidates)
http://gallery.svn.sourceforge.net/viewvc/gallery/trunk/gallery/
contrib/phpBB2/modules.php?view=markup
-Chris
Gallery Project Manager
--
Chris Kelly
ckdake@xxxxxxxxxx
http://ckdake.com/
On Jan 16, 2007, at 8:52 AM, me you wrote:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include
Vulnerability
Script : Gallery
Version : 1.4.4-pl4
URL : http://puzzle.dl.sourceforge.net/sourceforge/gallery/
gallery-1.6-alpha3.tar.gz
Author : BorN To K!LL
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Code in :. contrib/phpBB2/modules.php
include_once($phpbb_root_path . 'extension.inc');
include_once($phpbb_root_path . 'common.'.$phpEx);
include_once($phpbb_root_path . 'includes/functions.'.$phpEx);
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Explo!t :.
^^^^^
www.site.com/[path]/contrib/phpBB2/modules.php?
phpbb_root_path=shellcode.txt?
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
GreeTz to : Dr.2 , Asbmay , General C , ToOoFa ,
SHiKaA , str0ke ...
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! http://
search.msn.click-url.com/go/onm00200636ave/direct/01/
