search

bcit-ci / CodeIgniter

Open Source PHP Framework (originally from EllisLab)
https://codeigniter.com/
MIT License
18.28k stars 7.61k forks source link

Local file inclusion #568

Closed ErikNijlandSanoma closed 12 years ago

ErikNijlandSanoma commented 12 years ago

When setting $config['enable_query_strings'] to true CodeIgniter becomes vulnerable for local file inclusion.

E.g. http://www.example.com/index.php?c=../../../some/folders/.htpasswd%00

Where %00 represents a null-byte character. See http://ddxhunter.wordpress.com/2010/03/10/lfis-exploitation-techniques/ for a more detailed explanation of local file inclusion.

wildlyinaccurate commented 12 years ago

Have you got a working example? I can't replicate this.

derekjones commented 12 years ago

Commenting to subscribe.

ErikNijlandSanoma commented 12 years ago

@wildlyinaccurate I haven't since I just made a quickfix. But it might be dependent on PHP's magic quotes setting.

derekjones commented 12 years ago

Erik, feel free to message me privately with the full details if you wish, including environment information.

ErikNijlandSanoma commented 12 years ago

Can't replicate it with the latest CodeIgniter version. Issue appeared using version 1.7.2

derekjones commented 12 years ago

Ok, thanks for reporting just the same!