SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Forum/Board/Portal)  >   Simple PHP Blog Vendors:   Palmo, Alexander
Simple PHP Blog 'comment_delete_cgi.php' Lets Remote Users Delete Arbitrary Files
SecurityTracker Alert ID:  1014817
SecurityTracker URL:  http://securitytracker.com/id/1014817
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 30 2005
Impact:   Denial of service via network, Modification of system information, Modification of user information


Description:   A vulnerability was reported in Simple PHP Blog. A remote user can delete arbitrary files.

A coding error in 'comment_delete_cgi.php' lets remote users delete files with the privileges of the target web service.

If installation scripts remain on the target system, then a remote user can reset the administrative password.

'ken'@FTU reported this vulnerability.

Impact:   A remote user can delete files on the target system with the privileges of the target web service.
Solution:   No solution was available at the time of this entry.

As a workaround, the report indicates that you can make the following change in 'comment_delete_cgi.php':

from $logged_in = logged_in( false, true );
to $logged_in = logged_in( true, true );

Vendor URL:  www.simplephpblog.com/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  SimplePHPBlog Arbitrary File Deletion and Sample Exploit

SimplePHPBlog has a vulnerability in its comment_delete_cgi.php.

The PHP script allows for the arbitrary deletion of files.

Please see following link for a perl script to demonstrate the exploit:
http://www.ftusecurity.com/pub/sphpblog_vulns
(Please add .pl extension as my ISP server preprocesses the file if it 
is .pl or txt.)


This vulnerability, in combination with the fact that the installation
scripts are left on the server after installation, allows an arbitrary
user to reset the admin password to one of the attacker's choosing.

The script demonstrates the ability to delete files, reset the admin
password to the attacker's choosing and upload files (including a
command prompt).

The exploit is for educational purposes only.

To prevent this exploit change the line in comment_delete_cgi.php
from $logged_in = logged_in( false, true );
to $logged_in = logged_in( true, true );

Sincerely,
'ken'@FTU
Kenneth F. Belva, CISSP
http://www.ftusecurity.com

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC