Skip to content

Instantly share code, notes, and snippets.

@cedriczirtacic

cedriczirtacic/sarg_pfsense_0.6.10_LFI.patch

Created March 11, 2016 19:21
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save cedriczirtacic/767c8dd7b2a88e87bf05 to your computer and use it in GitHub Desktop.
Save cedriczirtacic/767c8dd7b2a88e87bf05 to your computer and use it in GitHub Desktop.
Download ZIP
Fix for Local File Inclusion (CWE-98) on sarg 0.6.10 pfSense package
Raw
sarg_pfsense_0.6.10_LFI.patch
--- sarg_frame.php.old 2016-03-11 14:25:58.000000000 -0300
+++ sarg_frame.php 2016-03-11 16:09:53.000000000 -0300
@@ -34,6 +34,11 @@
ini_set('memory_limit', '250M');
}
+// Small security check
+if(!empty($_REQUEST['file'])){
+ $_REQUEST['file']=preg_replace('/(\.+\/|\\\.*|\/{2,})*/',"", $_REQUEST['file']);
+}
+
if (preg_match("/(\S+)\W(\w+.html)/", $_REQUEST['file'], $matches)) {
// URL format
// https://192.168.1.1/sarg_reports.php?file=2012Mar30-2012Mar30/index.html
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment