Method for HACK SMF? ADMIN please fix this bug if is real

[edi67]

Browsing one forum i found this message:

Code Select Expand

Congrat for the new plugin, but I found this exploit on the wild (SMF exploit every version).

Just so you know..
Quote:
SMF forum ALL versions exploit

1) Get a PHP Shell (like c99shell)

2) RENAME it in c99.php.zip (DON'T PUT THE SHELL IN THE ARCHIVE BUT RENAME IT)

3) Now upload the renamed c99 like an attachment on the victim's SMF forum

4) Default admin is disabled the "encrypt filenames" option, so :

You can found the shell here:

[target]/[path]/attachments/c99.php.zip

5) You owned the website already
Just for the head up and keep up a good work

Well if this is one real HACK action , Admins please fix the problem of security.

Thx

[karlbenson]

This was posted on a forum back in early 2007
http://www.vivvo.net/forums/showthread.php?t=2020

I tested it for good measure.  Doesn't work now (or if it ever did)
As far as I'm aware it wouldn't execute anyway because it doesn't have the .php extension.

[Kindred]

As Karl Benson has said...

in addition, although the "encrypt filenames" might be disabled by default, it is your repsonsibility, as webstite administrator to check your own security. If you are concerned, enable "encrypt filenames".

and, you can disable the ability to upload .zip files as attachements...

[karlbenson]

and also you can move attachments out of a public area, so they can't access it directly.

[winrules]

For this to work the admin had to disable attachment file name encryption (contrary to the report it is enabled by default), and the server has to have a very strange configuration that sends zip files through the php parser.

[Grudge]

Indeed, this can only happen on a incorrectly configured server. There is no way whatsoever that ANY server configuration should parse every file as PHP - and it's never set up like that by default.

By the same token you could say that if the admin disables file name encryption and then allows users to upload PHP files that's an exploit - but clearly it's not - it's simply very, very poor management (And something we warn about!)