From 8070f622122344ae52b55c3f80e43a1733ae59e2 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Mon, 6 Nov 2017 14:24:24 +0100 Subject: 53 absolute path (#62) * Add error for relative path--- config/examples.ini | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) (limited to 'config/examples.ini') diff --git a/config/examples.ini b/config/examples.ini index c522f1a..68a363d 100644 --- a/config/examples.ini +++ b/config/examples.ini @@ -1,47 +1,47 @@ # Restrict system calls to specific file -sp.disable_function.function("system").filename("update.php").allow(); +sp.disable_function.function("system").filename("/update.php").allow(); sp.disable_function.function("system").drop(); # Restrict system calls to specific file with a specific hash -sp.disable_function.function("system").filename("update.php").hash("d27c6c5686bc129716b6aac8dfefe2d519a80eb6cc144e97ad42c728d423eed0").allow(); +sp.disable_function.function("system").filename("/update.php").hash("d27c6c5686bc129716b6aac8dfefe2d519a80eb6cc144e97ad42c728d423eed0").allow(); sp.disable_function.function("system").drop(); # AbanteCart 1.2.8 - Multiple SQL Injections -sp.disable_function.filename("static_pages/index.php").var("_SERVER[PHP_SELF").value_r("\"").drop().alias("XSS"); -sp.disable_function.filename("core/lib/language_manager.php").function("ALanguageManager>_clone_language_rows").param("from_language").value_r("[^0-9]").drop(); -sp.disable_function.filename("admin/model/tool/backup.php").function("ModelToolBackup>createBackupTask").param("data[table_list]").value_r("'").drop(); +sp.disable_function.filename("/static_pages/index.php").var("_SERVER[PHP_SELF").value_r("\"").drop().alias("XSS"); +sp.disable_function.filename("/core/lib/language_manager.php").function("ALanguageManager>_clone_language_rows").param("from_language").value_r("[^0-9]").drop(); +sp.disable_function.filename("/admin/model/tool/backup.php").function("ModelToolBackup>createBackupTask").param("data[table_list]").value_r("'").drop(); # Redaxo 5.2.0: Remote Code Execution via CSRF # See for details -sp.disable_function.filename("redaxo/src/addons/structure/pages/linkmap.php").function("substr").param("string").value_r("\"").drop(); +sp.disable_function.filename("/redaxo/src/addons/structure/pages/linkmap.php").function("substr").param("string").value_r("\"").drop(); # Guest Post: Vtiger 6.5.0 - SQL Injection -sp.disable_function.filename("modules/Calendar/Activity.php").function("save_module").param("query").value_r("[^0-9;]").drop(); +sp.disable_function.filename("/modules/Calendar/Activity.php").function("save_module").param("query").value_r("[^0-9;]").drop(); # The State of Wordpress Security # All In One WP Security & Firewall -sp.disable_function.filename("admin/wp-security-dashboard-menu.php").function("render_tab3").var("_REQUEST[tab]]").value_r("\"").drop(); +sp.disable_function.filename("/admin/wp-security-dashboard-menu.php").function("render_tab3").var("_REQUEST[tab]]").value_r("\"").drop(); # PHPKit 1.6.6: Code Execution for Privileged Users -sp.disable_function.filename("pkinc/func/default.php").function("move_uploaded_file").param("destination").value_r("\\.ph\\.+$").drop(); +sp.disable_function.filename("/pkinc/func/default.php").function("move_uploaded_file").param("destination").value_r("\\.ph\\.+$").drop(); # Coppermine 1.5.42: Second-Order Command Execution -sp.disable_function.filename("include/imageobject_im.class.php").function("exec").var("CONFIG[im_options]).value_r("[^a-z0-9]").drop(); -sp.disable_function.filename("forgot_passwd.php").function("cpg_db_query").var("CLEAN[id]").value_r("[^a-z0-9]").drop(); +sp.disable_function.filename("/include/imageobject_im.class.php").function("exec").var("CONFIG[im_options]).value_r("[^a-z0-9]").drop(); +sp.disable_function.filename("/forgot_passwd.php").function("cpg_db_query").var("CLEAN[id]").value_r("[^a-z0-9]").drop(); # CVE-2014-1610 - Mediawiki RCE -sp.disable_function.filename("includes/media/DjVu.php") -sp.disable_function.filename("includes/media/ImageHandler.php").var("_GET[page]").value_r("[^0-9]").drop() +sp.disable_function.filename("/includes/media/DjVu.php") +sp.disable_function.filename("/includes/media/ImageHandler.php").var("_GET[page]").value_r("[^0-9]").drop() # CVE-2017-1001000 - https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html -sp.disable_function.filename("wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_GET[id]").value_r("[^0-9]").drop(); -sp.disable_function.filename("wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_POST[id]").value_r("[^0-9]").drop(); \ No newline at end of file +sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_GET[id]").value_r("[^0-9]").drop(); +sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_POST[id]").value_r("[^0-9]").drop(); -- cgit v1.3