bugtraq - Arbitrary code execution in eping plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050609161743.28069.qmail@securityfocus.com>
Date: 9 Jun 2005 16:17:43 -0000
From: y0int@...oo.it
To: bugtraq@...urityfocus.com
Subject: Arbitrary code execution in eping plugin


www.RedC0de.org found the following error in eping:

Details
-------
Advisory name: Arbitrary code execution in eping plugin
Advisory number: 1
Application: eping
Aplication author:  apnovi3
Security-Risk: high - very high
Remote-Exploit: Yes
Discovered by: m00fd1 aka Tr|p

Introduction
------------
Eping is a simple php script executing the ping command,
eping is an plugin for e107 portal system.
Unfortunately a bug allows users to execute arbritary commands.

More details
------------
The problem is based upon the fact that not all user inputs are filtered
correctly. Variable $eping_host is not filtered using preg_replace.

Proof of concept
----------------
You must put an evil code in $eping_host variable...
Example: ?eping_host=127.0.0.1;ls...
         ?eping_host=127.0.0.1;cd%20/;cat%20/etc/passwd...

Security-Risk
-------------
Because an attacker is able to execute any php command, he is able to
read all files including .htaccess or .htpasswd files or any password
protected pages. Depending on system security he might be able to run
any shell command on the server. That is why we are rating this security
issue to high - very high.