MKPortal Include File Bug in 'language' Parameter Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016403
|
|
SecurityTracker URL: http://securitytracker.com/id?1016403
|
|
CVE Reference: CVE-2006-3554
(Links to External Site)
|
Updated: Aug 12 2008
|
Original Entry Date: Jun 28 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.0.1 Final
|
Description: A vulnerability was reported in MKPortal. A remote user can include and execute arbitrary code on the target system.
The software does not properly validate user-supplied input. A remote user can send a specially crafted 'gl_session' cookie value
to cause the value to be logged in the 'error_log' file. Then, the remote user can supply a specially crafted 'language' cookie
value to cause the target system to include and execute arbitrary PHP code from a the error_log file. The PHP code, including operating
system commands, will run with the privileges of the target web service.
rUnViRuS (worlddefacers.de) discovered this vulnerability.
A
demonstration exploit is available at:
http://www.worlddefacers.de/Public/WD-MKP.txt
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.mkportal.it/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: stormhacker@hotmail.com
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 28 Jun 2006 18:39:58 +0000
From: stormhacker@hotmail.com
Subject: MKPortal 1.0.1 Final ($ind) File Include Vulnerability (perl)
|
Welcome people In World Defacers Team
[W]orld [D]efacers Team
======================================
--------------------Summary----------------
eVuln ID: WD21
Vendor: MKPortal 1.0.1 Final
Vendor's Web Site: wttp://www.kaimanweb.net
Software: Live Customer Support Solution :- http://www.thegymratz.com
Class: Remote
PoC/Exploit: Available
Solution: Not Available
Discovered by: rUnViRuS (worlddefacers.de)
-----------------Description---------------
$ind File Include Vulnerability
--------------PoC/Exploit----------------------
http://www.worlddefacers.de/Public/WD-MKP.txt
--------------Solution---------------------
No Patch available.
--------------Credit-----------------------
Discovered by: rUnViRuS (worlddefacers.de)
|
|
