Jcow Social Networking Script 'attachment' Parameter Remote PHP Code Execution Vulnerability

Bugtraq ID:	49324
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 26 2011 12:00AM
Updated:	Aug 26 2011 12:00AM
Credit:	Aung Khant, YGN Ethical Hacker Group.
Vulnerable:	Jcow Jcow 5.2 Jcow Jcow 4.3 Jcow Jcow 4.2.1
Not Vulnerable:	Jcow Jcow 5.3 Jcow Jcow 4.3.1

Jcow Social Networking Script 'attachment' Parameter Remote PHP Code Execution Vulnerability

Jcow is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

Versions prior to Jcow 4.3.1 and 5.3 are vulnerable.

Jcow Social Networking Script 'attachment' Parameter Remote PHP Code Execution Vulnerability

Attackers can exploit this issue through a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/49324.rb

Jcow Social Networking Script 'attachment' Parameter Remote PHP Code Execution Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

Jcow Social Networking Script 'attachment' Parameter Remote PHP Code Execution Vulnerability

References:

• Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution (YGN Ethical Hacker Group)
  
• Jcow Homepage (Jcow )