BID:14490

SysCP Multiple Script Execution Vulnerabilities

Info

SysCP Multiple Script Execution Vulnerabilities

Bugtraq ID:	14490
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 08 2005 12:00AM
Updated:	Aug 08 2005 12:00AM
Credit:	Discovery is credited to Christopher Kunz <[email protected]> with Hardened PHP Project.
Vulnerable:	SysCP SysCP 1.2.10 SysCP SysCP 1.2.9 SysCP SysCP 1.2.8 SysCP SysCP 1.2.7 SysCP SysCP 1.2.6 SysCP SysCP 1.2.5 SysCP SysCP 1.2.4 SysCP SysCP 1.2.3 SysCP SysCP 1.2.2 SysCP SysCP 1.2.1

Not Vulnerable:	SysCP SysCP 1.2.11

Discussion

SysCP Multiple Script Execution Vulnerabilities

SysCP is affected by multiple script execution vulnerabilities.

The following specific vulnerabilities were identified:

The application is affected by a remote file include vulnerability. An attacker can include remote script code and execute it in the context of an affected server.

Another script code execution vulnerability may allow an attacker to call arbitrary functions and scripts by bypassing a PHP eval() statement.

SysCP 1.2.10 and prior versions are prone to these vulnerabilities.

Exploit / POC

SysCP Multiple Script Execution Vulnerabilities

An exploit is not required.

The following string is sufficient to bypass the eval() call:
{${phpinfo();}}