PHPDig Config.PHP Include Remote Command Execution Vulnerability

Bugtraq ID:	9424
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2004 12:00AM
Updated:	Jan 14 2004 12:00AM
Credit:	Discovery credited to FraMe.
Vulnerable:	PhpDig PhpDig 1.6.5 PhpDig PhpDig 1.6.4 PhpDig PhpDig 1.6.3 PhpDig PhpDig 1.6.2 PhpDig PhpDig 1.6.1 PhpDig PhpDig 1.6 PhpDig PhpDig 1.4.8 PhpDig PhpDig 1.4.7 PhpDig PhpDig 1.4.6 PhpDig PhpDig 1.4.5 c PhpDig PhpDig 1.4.5 b PhpDig PhpDig 1.4.5 PhpDig PhpDig 1.4.4 c PhpDig PhpDig 1.4.4 b PhpDig PhpDig 1.4.4 PhpDig PhpDig 1.4.3 PhpDig PhpDig 1.4.2 PhpDig PhpDig 1.4.1 PhpDig PhpDig 1.4 -2 PhpDig PhpDig 1.4
Not Vulnerable:

PHPDig Config.PHP Include Remote Command Execution Vulnerability

A problem has been identified in the handling of includes in PhpDig. Because of this, it may be possible for a remote user to gain unauthorized access to a vulnerable host.

PHPDig Config.PHP Include Remote Command Execution Vulnerability

No exploit is required for this vulnerability.

PHPDig Config.PHP Include Remote Command Execution Vulnerability

Solution:
A solution has been posted to PHPDig that deals with this issue:

!!! ADD THIS TO THE TOP OF THE CONFIG.PHP FILE NOW !!!

PHP:
--------------------------------------------------------------------------------

// prevent remote command execution
if ((isset($relative_script_path)) &&
($relative_script_path != ".") &&
($relative_script_path != "..")) {
exit();
}

// prevent requests for config.php
if (eregi("config.php",$_SERVER['SCRIPT_FILENAME']) ||
eregi("config.php",$_SERVER['REQUEST_URI'])) {
exit();
}

--------------------------------------------------------------------------------

Please see reference section for more details.

A patched version has been provided for this issue.


PhpDig PhpDig 1.6.5

• PhpDig phpdig-1.6.5.zip
  http://www.phpdig.net/download.php?digfile=phpdig-1.6.5.zip