bugtraq - phphelpdesk Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 2 Nov 2007 22:53:35 -0000
From: Joseph.giron13@...il.com
To: bugtraq@...urityfocus.com
Subject: phphelpdesk Multiple vulnerabilities

phphelpdesk version 0.6.16 (latest)

http://phphelpdesk.sourceforge.net

phphelpdesk Multiple vulnerabilities

PhpHelpDesk is a popular solution for people looking for a way to manage their helpdesk tickets.
Presently there exists 2 vulnerabilites that affect the inegrity of systems who run the software.
The first of which is a local file inclusuion vulnerability. Problem exists in the GET'd variable
whatdodo. Its supposed to point to a series of pages, but the filter fails to catch users going
outside the lines with a little trailing null bye. Here is an example:

http://helpdesk.example/index.php?whattodo=../../../../../../../../etc/passwd%00

Reading files seems bad, but not that bad. The second vulnerability in question is the SQL
Injection at the login page. Yes, the classic ' or 1=1/* injection still holds true in the
login procedures of this app. 

I've emailed the project dev on sourceforge and am awaiting a response. 

Happy hacking.