Hi everyone !
It's my first mail on this mailing list, I hope I could help you :)
In the file : apertium/webspace/index.php
<?php
$headerFile = "content/" . $lang . "/header.html";
if( file_exists($headerFile) ) {
include_once($headerFile);
} else {
include_once("content/en/header.html");
}
?>
Cause to "register_global", you can give variable by URL ( here $lang ).
You can finish your string with the null byte code ( \0, %00 ). It cuts the
$headerFile, and doesn't add "/header.html" to the end.
So, for example,
http://www.apertium.org/?id=whatisapertium&lang=../images/langiconclassic_r9_c24.png
will include the "code" of the picture /langiconclassic_r9_c24.png (safety
example, of course :) )
In addition, because this variable is show without any filter, you can use
"XSS attacks". It's like this safety example :
http://www.apertium.org/?id=whatisapertium&lang=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
I think there several times this problem in *.php files.
Thanks for attention,
Regards,
Ajax ([email protected])
------------------------------------------------------------------------------
Create and publish websites with WebMatrix
Use the most popular FREE web apps or write code yourself;
WebMatrix provides all the features you need to develop and
publish your website. http://p.sf.net/sfu/ms-webmatrix-sf
_______________________________________________
Apertium-stuff mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/apertium-stuff
