DigitalHive Include File Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1017095
|
|
SecurityTracker URL: http://securitytracker.com/id?1017095
|
|
CVE Reference: CVE-2006-5493
(Links to External Site)
|
Updated: Jun 3 2008
|
Original Entry Date: Oct 20 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 2.0 RC2
|
Description: A vulnerability was reported in DigitalHive. A remote user can include and execute arbitrary code on the target system.
The 'base_include.php' script does not properly validate user-supplied input in the 'page' parameter. A remote user can supply a
specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code,
including operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/[Path]/templat
e/purpletech/base_include.php?page=shell.txt?
Mahmood_ali discovered this vulnerability.
|
Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.digitalhive.com/ (Links to External Site)
|
Cause: Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "mahmood ali" <mah_k_2000@hotmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 18 Oct 2006 23:53:51 +0000
From: "mahmood ali" <mah_k_2000@hotmail.com>
Subject: DigitalHive 2.0 RC2 (base_include.php)File Include
|
###################################
DigitalHive 2.0 RC2 (base_include.php)File Include
###################################
Source Code:
http://www.comscripts.com/jump.php?action=script&id=1502
###################################
Vulnerable Code:_
include ($_GET["page"]);
###################################
Exploit :
http://www.vicTim.com/[Path]/template/purpletech/base_include.php?page=shell.txt?
###################################
Discoverd By : Mahmood_ali
Conatact : mah_k_2000@hotmail.com
###################################
Special Greetings :_ Tryag-Team
###################################
_________________________________________________________________
Windows Live™ Messenger has arrived. Click here to download it for free!
http://imagine-msn.com/messenger/launch80/?locale=en-gb
|
|
