cryptographp v1.4: file contents disclosure bug

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052107 漏洞类型
发布时间 2009-03-16 更新时间 2009-03-16
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2009030032
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
Cryptographp - a `free` captcha script

I contacted the author on 2009-02-11 via e-mail but I did not get a response.
I feel the need users of that script should be aware of such a bug.

The main include of that script has the following PHP code:

#####
if (is_file($_GET['cfg']) and dirname($_GET['cfg'])=='.' )
$_SESSION['configfile']=$_GET['cfg'];
  else  $_SESSION['configfile']="cryptographp.cfg.php";

include($_SESSION['configfile']):
#####

This enables an attacker to output any file in the current directory,
where cryptographp has been installed.
For example you can read .ht* files like .htpasswd, .htaccess


Vulnerable: Latest Version 1.4 (did not check below)