bugtraq - [KIS-2013-01] DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b753a8033f39627ea795e78c170bac61@karmainsecurity.com>
Date: Mon, 28 Jan 2013 18:52:10 +0100
From: Egidio Romano <research@...mainsecurity.com>
To: <bugtraq@...urityfocus.com>
Subject: [KIS-2013-01] DataLife Engine 9.7 (preview.php) PHP Code Injection
 Vulnerability

------------------------------------------------------------------
DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability
------------------------------------------------------------------

• Software Link:

http://dleviet.com/


• Affected Version:

9.7 only.


• Vulnerability Description:

The vulnerable code is located in the /engine/preview.php script:

246.	$c_list = implode (',', $_REQUEST['catlist']);
247.
248.	if( strpos( $tpl->copy_template, "[catlist=" ) !== false ) {
249.		$tpl->copy_template = preg_replace( 
"#\\[catlist=(.+?)\\](.*?)\\[/catlist\\]#ies", "check_category('\\1', 
'\\2', '{$c_list}')", $tpl->copy_template );
250.	}
251.
252.	if( strpos( $tpl->copy_template, "[not-catlist=" ) !== false ) {
253.		$tpl->copy_template = preg_replace( 
"#\\[not-catlist=(.+?)\\](.*?)\\[/not-catlist\\]#ies", 
"check_category('\\1', '\\2', '{$c_list}', false)", $tpl->copy_template 
);
254.	}

User supplied input passed through the $_REQUEST['catlist'] parameter 
is not properly
sanitized before being used in a preg_replace() call with the e 
modifier at lines 249 and 253.
This can be exploited to inject and execute arbitrary PHP code. 
Successful exploitation of
this vulnerability requires a template which contains a “catlist” (or a 
“not-catlist”) tag.


• Solution:

Apply the vendor patch: 
http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html


• Disclosure Timeline:

[16/01/2013] – Vendor notified
[19/01/2013] – Vendor patch released
[20/01/2013] – CVE number requested
[21/01/2013] – CVE number assigned
[28/01/2013] – Public disclosure


• CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1412 to this vulnerability.


• Credits:

Vulnerability discovered by Egidio Romano.


• Original Advisory:

http://karmainsecurity.com/KIS-2013-01