Security Fix Released! Admin access PHPSELF issue

Sal · **Joined:** Wed Jul 30, 2003 12:00 am **Posts:** 1369

Security Fix Released! For all CRE Loaded users to protect your admin from PHPSELF exploit.
Download the security fix for your specific version. Current patch level required.

http://www.creloaded.com/fdm_folder_fil ... CDpath=175

Use this forum thread to discuss this issues for 6.2 users.

cheapo · **Posted:** Tue Sep 01, 2009 8:29 pm

What about 6.3.x users?

cheapo · **Posted:** Tue Sep 01, 2009 9:13 pm

Okay I found instructions for 6.3.x in the creloaded62standard_wl_v6.2.14a_Security_PHPSELF.zip file but the manual instructions give an error....

Code:

For 6.3 and 6.4 sites, Find line:
$PHP_SELF = (isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : 
$_SERVER['SCRIPT_NAME']);

Replace with:
$PHP_SELF = $_SERVER['SCRIPT_NAME']);

saying there is an unexpected ")".

So I suspect the instructions need to say:

Code:

For 6.3 and 6.4 sites, Find line:
$PHP_SELF = (isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : 
$_SERVER['SCRIPT_NAME']);

Replace with:
$PHP_SELF = $_SERVER['SCRIPT_NAME'];

--- Just remove the )

Plus in the instructions it mentions only "download and edit your admin/includes/application_top.php" but shouldn't this change also be made in "includes/application_top.php" also? Can anyone confirm?

On a second note: How can we test the vuneribility to see it in action, then after this fix is applied, to see that it is stopped?

Thanks,

Mike

Nimitz1061 · **Posted:** Sat Sep 05, 2009 3:10 pm

It is probably best to replace this where ever it is found. And those 2 files are not the only places...

Interesting question for me is, why has this not been posted to the admin security alert block embedded in all CRE admin tools....

David

cris · **Posted:** Wed Apr 07, 2010 5:31 pm

Quote:

Security Fix Released! For all CRE Loaded users to protect your admin from PHPSELF exploit.
Download the security fix for your specific version. Current patch level required.

http://www.creloaded.com/fdm_folder_fil ... CDpath=175

This link goes to a blank page. Is there a new link for the secure fix?

Thanks,
c.

Kirk · **Joined:** Thu Jul 13, 2006 12:00 am **Posts:** 653

http://www.creloaded.com/fdm_folder_fil ... fPath=0_69

on_way_to_fame · **Joined:** Wed Jul 05, 2006 12:00 am **Posts:** 56

Hi,

I just tried to install this for my CRE Loaded 6.2 Standard using the manual instructions, however I get this error:

Code:

Parse error: syntax error, unexpected ')' in /home/mge0908/public_html/fashionobsessed/admin/includes/application_top.php on line 67

Here are the manual instructions given in the fix:

Code:

For 6.15 and 6.2 sites, find line:
$PHP_SELF = (isset($HTTP_SERVER_VARS['PHP_SELF']) ? 
$HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_SERVER_VARS['SCRIPT_NAME']);

Replace with:
$PHP_SELF = $HTTP_SERVER_VARS['SCRIPT_NAME']);

While, I am no programmer, I believe this is probably because ) should not be there in the "Replace With" file. Could someone please confirm this, so that I can patch my file.

Thanks

cheapo · **Posted:** Wed Aug 25, 2010 4:34 pm

Look 5 posts up ^

neomorph · **Joined:** Sat Oct 09, 2010 10:10 am **Posts:** 3

is this still available? appears there's no longer a download link?

v0ldemar · **Joined:** Sun Nov 21, 2010 1:02 am **Posts:** 5

Here is good news for all the CRE Loaded users. It has been a long wait for them for this Security Fix. It is easy to install. Just go to the link given here and you can download and install that. But just be careful because that security fix given here is for the 6.2 users only. For the 6.3.x users, another version has to be used. So, there is nothing to worry regarding the PHPSELF exploit.

ritika · **Joined:** Fri Aug 26, 2011 2:14 am **Posts:** 1

Hi Guys,
Without logging into your admin panel, hacker can access to your site via:
http://[www.kaamnagreensikka.com]/admin/categories.php/login.php?cPath=&action=new_product_preview

https://[www.kaamnagreensikka.com]/admin/file_manager.php/login.php

To patch your site, open /admin/includes/application_top.php

find: $current_page = basename($PHP_SELF); around Line 136

replace:
$current_page = basename($_SERVER['SCRIPT_NAME']);

Regards,
Ritika
kaamnagreensikka

CRE Loaded Community

Security Fix Released! Admin access PHPSELF issue

Who is online

Main Menu

Login

Top Listing

Members Online

Follow Us on Twitter

CRE Loaded Community Chat hosted by CRE Loaded.