lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 27 Jul 2009 22:13:58 +0630
From: "YGN Ethical Hacker Group (http://yehg.net)" <lists@...g.net>
To: full-disclosure@...ts.grok.org.uk
Subject: PHP Support Ticket 2.2 <= Multiple Vulnerabilities

==============================================================================
 PHP Support Ticket 2.2 <= Multiple Vulnerabilities
==============================================================================

Discovered by
Aung Khant, YGN Ethical Hacker Group, Myanmar http://yehg.net/ ~
believe in full disclosure

Advisory URL:http://yehg.net/lab/pr0js/advisories/php_support_ticket-2.2
Date published: 2009-07-23
Severity: High

Vendor: Triangle Solutions Ltd (http://www.triangle-solutions.com/)
Script URL: http://www.phpsupporttickets.com/

Demo URL:http://www.phpsupporttickets.com/modules/phpsupporttickets.com/demo/


Overview
==========
This version of PHP Support Ticket is bundled together in today's one-click
script installer of all/most web hosting providers. Customers have no clue
of the vulnerabilities. Hosting providers always say marketing voice -
easy deployment, one-click installation - but no security.

###########################################################################

#1. Lack Of "install" directory removal check

This will allow attackers to overwrite existing config files with junk data,
making the PHP Ticket application stop working. In extreme case, advanced
attackers will inject valid php codes to do more harm.


#2. Hidden Debug paramter (tri_debug)

File: /include/config.php
Code:
	// Conditional Error Reporting
	if (isset($_GET['tri_debug'])) {
		$set_ini = ini_set('display_errors', 1);
		error_reporting(E_ALL);

This will provide attackers every feedback for his attacking.
For small case, this provides internal path disclosure. 	


#3. Addon: PHPMailer Remote Code Execution

PHP Support Ticket employed vulnerable version of PHPMailer class.

File: /classes/class.phpmailer.php
Code:
	if ($this->Sender != "")
		$sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender);
	else
		$sendmail = sprintf("%s -oi -t", $this->Sendmail);




###########################################################################

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists