PHPsFTPd Inc.Login.PHP Privilege Escalation Vulnerability

Bugtraq ID:	14222
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 12 2005 12:00AM
Updated:	Jul 12 2005 12:00AM
Credit:	Steve <[email protected]> is credited with the discovery if this vulnerability.
Vulnerable:	PHPsFTPd PHPsFTPd 0.4 + WhitSoft SlimFTPd 3.15 + WhitSoft SlimFTPd 3.14 PHPsFTPd PHPsFTPd 0.2
Not Vulnerable:	PHPsFTPd PHPsFTPd 0.5

PHPsFTPd Inc.Login.PHP Privilege Escalation Vulnerability

PHPsFTPd is affected by a privilege escalation vulnerability. PHPsFTPd is affected by a privilege escalation vulnerability. This issue is due to a failure in 'inc.login.php' when processing login credentials.

An attacker can exploit this vulnerability to retrieve the administrator username and password. This could aid in further attacks against the underlying system; other attacks are also possible.

PHPsFTPd Inc.Login.PHP Privilege Escalation Vulnerability

No exploit is required.

The following exploit is available:

• /data/vulnerabilities/exploits/PHPsFTPd_exp.c

PHPsFTPd Inc.Login.PHP Privilege Escalation Vulnerability

Solution:
This issue has been addressed in version 0.5.


PHPsFTPd PHPsFTPd 0.2

• PHPsFTPd PHPsFTPd 0.5
  http://prdownloads.sourceforge.net/phpsftpd/phpsftpd0.5.zip?download

PHPsFTPd PHPsFTPd 0.4

• PHPsFTPd PHPsFTPd 0.5
  http://prdownloads.sourceforge.net/phpsftpd/phpsftpd0.5.zip?download

PHPsFTPd Inc.Login.PHP Privilege Escalation Vulnerability

References:

• PHPsFTPd 0.5 Release Notes (PHPsFTPd)
  
• PHPsFTPd Homepage (PHPsFTPd)
  
• PHPsFTPd - Admin password leak (Steve )