PHP Microsoft Windows Shell Escape Functions Command Execution Vulnerability
BID:10471
Info
PHP Microsoft Windows Shell Escape Functions Command Execution Vulnerability
| Bugtraq ID: | 10471 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 07 2004 12:00AM |
| Updated: | Jun 07 2004 12:00AM |
| Credit: | Discovery of this issue is credited to "Daniel Fabian" <[email protected]>. Discovery is also credited to 3APA3A. |
| Vulnerable: |
PHP PHP 4.3.5 PHP PHP 4.3.3 |
| Not Vulnerable: |
PHP PHP 4.3.7 |
Discussion
PHP Microsoft Windows Shell Escape Functions Command Execution Vulnerability
PHP is reportedly prone to a command execution vulnerability in its shell escape functions. This issue is due to a failure of PHP to properly sanitize function arguments.
This issue might allow an attacker to execute arbitrary shell commands on a computer running the vulnerable software within the security context of the web server; potentially leading to unauthorized access. Other attacks are also possible.
This issue is reported to affect PHP under Microsoft Windows version 4.3.3 and 4.3.5, it is likely that other Microsoft Windows versions are affected as well.
PHP is reportedly prone to a command execution vulnerability in its shell escape functions. This issue is due to a failure of PHP to properly sanitize function arguments.
This issue might allow an attacker to execute arbitrary shell commands on a computer running the vulnerable software within the security context of the web server; potentially leading to unauthorized access. Other attacks are also possible.
This issue is reported to affect PHP under Microsoft Windows version 4.3.3 and 4.3.5, it is likely that other Microsoft Windows versions are affected as well.
Exploit / POC
PHP Microsoft Windows Shell Escape Functions Command Execution Vulnerability
No exploit is required to leverage this issue. It has been reported that the following input passed to a vulnerable function will trigger this issue and execute the 'dir' command:
" || dir ||
No exploit is required to leverage this issue. It has been reported that the following input passed to a vulnerable function will trigger this issue and execute the 'dir' command:
" || dir ||
Solution / Fix
PHP Microsoft Windows Shell Escape Functions Command Execution Vulnerability
Solution:
The vendor has released an upgrade dealing with this issue.
PHP PHP 4.3.3
PHP PHP 4.3.5
Solution:
The vendor has released an upgrade dealing with this issue.
PHP PHP 4.3.3
-
PHP PHP 4.3.7
http://www.php.net/downloads.php
PHP PHP 4.3.5
-
PHP PHP 4.3.7
http://www.php.net/downloads.php
References
PHP Microsoft Windows Shell Escape Functions Command Execution Vulnerability
References:
References:
- PHP 4 ChangeLog (PHP)
- PHP Win32 escapeshellcmd() and escapeshellarg() Input Validation Vulnerability (iDEFENSE)
- PHP escapeshellarg Windows Vulnerability ("Daniel Fabian"