Dayfox Blog Postpost.PHP Remote PHP Code Execution Vulnerability
BID:22972
Info
Dayfox Blog Postpost.PHP Remote PHP Code Execution Vulnerability
| Bugtraq ID: | 22972 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-1525 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 14 2007 12:00AM |
| Updated: | May 12 2015 07:33PM |
| Credit: | Dj7xpl is credited with the discovery of this vulnerability. |
| Vulnerable: |
Dayfox Dayfox Blog 4.5 |
| Not Vulnerable: |
Dayfox Dayfox Blog 4.6 |
Discussion
Dayfox Blog Postpost.PHP Remote PHP Code Execution Vulnerability
Dayfox Blog is prone to an arbitrary PHP code-execution vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible.
Dayfox Blog 4.5 is vulnerable to this issue; other versions may also be affected.
Dayfox Blog is prone to an arbitrary PHP code-execution vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible.
Dayfox Blog 4.5 is vulnerable to this issue; other versions may also be affected.
Exploit / POC
Dayfox Blog Postpost.PHP Remote PHP Code Execution Vulnerability
Attackers can use a browser to exploit this issue.
A sample proof-of-concept URI has been provided:
http://www.example.com/dfblog/posts.php?cmd=ls -la
Attackers can use a browser to exploit this issue.
A sample proof-of-concept URI has been provided:
http://www.example.com/dfblog/posts.php?cmd=ls -la
Solution / Fix
Dayfox Blog Postpost.PHP Remote PHP Code Execution Vulnerability
Solution:
The vendor has addressed this issue in Dayfox Blog 4.6. Please contact the vendor for details on obtaining and applying the appropriate updates.
Solution:
The vendor has addressed this issue in Dayfox Blog 4.6. Please contact the vendor for details on obtaining and applying the appropriate updates.
References
Dayfox Blog Postpost.PHP Remote PHP Code Execution Vulnerability
References:
References:
- Dayfox Blog Download Page (Dayfox)
- Vendor Homepage (Dayfox)