Tell a Friend Script Lets Remote Users Include and Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013390
|
|
SecurityTracker URL: http://securitytracker.com/id?1013390
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 7 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 2.7
|
Description: An include file vulnerability was reported in the STADTAUS.com 'Tell a Friend Script' software. A remote user can execute arbitrary commands on the target system.
The 'inc/tell_a_friend.inc.php' component does not properly validate user-supplied input. A remote user can submit a specially crafted
'script_root' parameter to cause the target system to include and execute arbitrary PHP code from a remote web server. The arbitrary
PHP code, including operating system commands, will run with the privileges of the target web service.
Filip Groszynski reported
this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: The vendor has issued a fixed version (2.7), available at:
http://www.stadtaus.com/en/php_scripts/tell_a_friend_script/
|
Vendor URL: www.stadtaus.com/forum/p-5897.html (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 7 Mar 2005 16:25:34 -0500
Subject: [none]
|
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Author: Filip Groszynski (VXSfx)
Date: 4 March 2005
-- == -- == -- == -- == -- == -- == -- == -- == -- == --
Vulnerable code in inc/tell_a_friend.inc.php:
...
/*****************************************************
** Include functions
*****************************************************/
include $script_root . 'inc/functions.inc.php';
include $script_root . 'inc/template.class.inc.php';
include $script_root . 'inc/template.ext.class.inc.php';
include $script_root . 'inc/formmail.class.inc.php';
...
include $script_root . 'languages/language.' . $language . '.inc.php';
...
|
|
