PHPsysInfo Multiple Input Validation Vulnerabilities
BID:15414
Info
PHPsysInfo Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 15414 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3347 CVE-2005-3348 CVE-2003-0536 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 14 2005 12:00AM |
| Updated: | Mar 17 2006 04:30PM |
| Credit: | The vendor disclosed these vulnerabilities. |
| Vulnerable: |
phpSysInfo phpSysInfo 2.4 phpSysInfo phpSysInfo 2.3 phpSysInfo phpSysInfo 2.1 phpSysInfo phpSysInfo 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Gentoo Linux eGroupWare eGroupWare 1.0 .0.007 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 |
| Not Vulnerable: |
phpSysInfo phpSysInfo 2.4.1 |
Discussion
PHPsysInfo Multiple Input Validation Vulnerabilities
phpSysinfo is prone to multiple input-validation vulnerabilities:
- a local file-include issue
- an HTTP response-splitting vulnerability
- cross-site scripting attacks.
These issues are due to a lack of proper sanitization of user-supplied input.
An attacker may exploit these vulnerabilities to access files within the context of the webserver application, to poison web proxy server caches, and to execute arbitrary HTML and script code within the context of the victim's browser.
Other attacks are also possible.
Note that the cross-site scripting issues are not exploitable on Debian systems.
phpSysinfo is prone to multiple input-validation vulnerabilities:
- a local file-include issue
- an HTTP response-splitting vulnerability
- cross-site scripting attacks.
These issues are due to a lack of proper sanitization of user-supplied input.
An attacker may exploit these vulnerabilities to access files within the context of the webserver application, to poison web proxy server caches, and to execute arbitrary HTML and script code within the context of the victim's browser.
Other attacks are also possible.
Note that the cross-site scripting issues are not exploitable on Debian systems.
Exploit / POC
PHPsysInfo Multiple Input Validation Vulnerabilities
No exploit is required.
Example URI have been provided:
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00&lng=../../README%00
http://www.example.com/index.php?sensor_program=lmsensors.inc.php/../../README%00
http://www.example.com/index.php?VERSION=%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
No exploit is required.
Example URI have been provided:
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00&lng=../../README%00
http://www.example.com/index.php?sensor_program=lmsensors.inc.php/../../README%00
http://www.example.com/index.php?VERSION=%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
Solution / Fix
PHPsysInfo Multiple Input Validation Vulnerabilities
Solution:
These vulnerabilities have been fixed in the 2.4.1 release of phpSysinfo. Please see the referenced advisories for further information.
eGroupWare eGroupWare 1.0 .0.007
phpSysInfo phpSysInfo 2.0
phpSysInfo phpSysInfo 2.1
phpSysInfo phpSysInfo 2.3
phpSysInfo phpSysInfo 2.4
Solution:
These vulnerabilities have been fixed in the 2.4.1 release of phpSysinfo. Please see the referenced advisories for further information.
eGroupWare eGroupWare 1.0 .0.007
-
Debian egroupware-addressbook_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-a ddressbook_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-bookmarks_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-b ookmarks_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-calendar_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-c alendar_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-comic_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-c omic_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-core_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-c ore_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-developer-tools_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-d eveloper-tools_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-email_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-e mail_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-emailadmin_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-e mailadmin_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-etemplate_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-e template_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-felamimail_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f elamimail_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-filemanager_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f ilemanager_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-forum_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f orum_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-ftp_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f tp_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-fudforum_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f udforum_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-headlines_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-h eadlines_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-infolog_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-i nfolog_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-jinn_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-j inn_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-ldap_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-l dap_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-manual_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-m anual_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-messenger_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-m essenger_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-news-admin_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-n ews-admin_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-phpbrain_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p hpbrain_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-phpldapadmin_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p hpldapadmin_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-phpsysinfo_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p hpsysinfo_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-polls_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p olls_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-projects_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p rojects_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-registration_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-r egistration_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-sitemgr_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-s itemgr_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-stocks_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-s tocks_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-tts_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-t ts_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-wiki_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-w iki_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware_1 .0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-bookmarks_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-b ookmarks_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-calendar_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-c alendar_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-comic_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-c omic_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-core_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-c ore_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-developer-tools_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-d eveloper-tools_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-email_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-e mail_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-emailadmin_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-e mailadmin_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-etemplate_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-e template_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-felamimail_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f elamimail_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-filemanager_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f ilemanager_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-forum_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f orum_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-ftp_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f tp_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-fudforum_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-f udforum_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-headlines_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-h eadlines_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-infolog_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-i nfolog_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-jinn_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-j inn_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-ldap_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-l dap_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-manual_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-m anual_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-messenger_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-m essenger_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-news-admin_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-n ews-admin_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-phpbrain_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p hpbrain_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-phpldapadmin_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p hpldapadmin_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-phpsysinfo_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p hpsysinfo_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-polls_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p olls_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-projects_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-p rojects_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-registration_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-r egistration_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-sitemgr_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-s itemgr_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-stocks_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-s tocks_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-tts_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-t ts_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware-wiki_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware-w iki_1.0.0.007-2.dfsg-2sarge4_all.deb -
Debian egroupware_1.0.0.007-2.dfsg-2sarge4_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/e/egroupware/egroupware_1 .0.0.007-2.dfsg-2sarge4_all.deb
phpSysInfo phpSysInfo 2.0
-
phpSysinfo phpSysInfo-2.4.1.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.1.tar.gz
phpSysInfo phpSysInfo 2.1
-
phpSysinfo phpSysInfo-2.4.1.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.1.tar.gz
phpSysInfo phpSysInfo 2.3
-
phpSysinfo phpSysInfo-2.4.1.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.1.tar.gz
phpSysInfo phpSysInfo 2.4
-
phpSysinfo phpSysInfo-2.4.1.tar.gz
http://prdownloads.sourceforge.net/phpsysinfo/phpSysInfo-2.4.1.tar.gz
References
PHPsysInfo Multiple Input Validation Vulnerabilities
References:
References:
- phpSysinfo Download Page at Sourceforge (phpSysinfo)
- phpSysInfo Homepage (phpSysInfo)
- Advisory 22/2005: Multiple vulnerabilities in phpSysInfo (Christopher Kunz