phpSecurePages Included File Arbitrary Command Execution Vulnerability

Bugtraq ID:	2970
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 02 2001 12:00AM
Updated:	Jul 02 2001 12:00AM
Credit:	Published in a Secure Reality Security Advisory on July 2, 2001.
Vulnerable:	phpSecurePages phpSecurePages 0.24 beta phpSecurePages phpSecurePages 0.23 beta phpSecurePages phpSecurePages 0.22 beta phpSecurePages phpSecurePages 0.21 beta phpSecurePages phpSecurePages 0.20 beta phpSecurePages phpSecurePages 0.19 beta phpSecurePages phpSecurePages 0.18 beta phpSecurePages phpSecurePages 0.17 beta phpSecurePages phpSecurePages 0.16 beta phpSecurePages phpSecurePages 0.15 beta phpSecurePages phpSecurePages 0.14 beta phpSecurePages phpSecurePages 0.13 beta phpSecurePages phpSecurePages 0.12 beta phpSecurePages phpSecurePages 0.11 beta
Not Vulnerable:

phpSecurePages Included File Arbitrary Command Execution Vulnerability

phpSecurePages is a PHP module to secures pages with a login name and password.

An input validation error exists that could enable remote users to cause the 'interface.php' script used by phpSecurePages to be loaded from an arbitrary location. The problem occurs when the 'cfgProgPath' variable is submitted as part of query element is submitted as part of a request.

As a result, it is possible for a remote user to specify the URL of a site containing a malicious 'interface.php' file as the 'cfgProgPath' variable. This will cause any code in the file to be executed by the checklogin.php script on the site running phpSecurePages, with the privileges of the webserver.

phpSecurePages Included File Arbitrary Command Execution Vulnerability

Solution:
This issue is rectified in versions 0.25beta and higher of phpSecurePages:


phpSecurePages phpSecurePages 0.24 beta

• phpSecurePages phpSecurePages 0.25beta
  http://www.bnr.nl/bigdeal/download/phpSecurePages.zip

phpSecurePages Included File Arbitrary Command Execution Vulnerability

References:

• phpSecurePages Homepage (phpSecurePages)