Horde Horde_Image::factory driver Argument Local File Inclusion

2011.02.14
Credit: skysbsb
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22


Ogólna skala CVSS: 6.4/10
Znaczenie: 4.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

# Exploit Title: Horde Horde_Image::factory driver Argument Local File Inclusion # Google Dork: intitle:horde # Date: 10-02-2011 # Author: skysbsb # Software Link: http://www.horde.org/download/ # Version: Horde 3.3.2 # Tested on: linux # CVE : CVE-2009-0932 The original disclosure was done by Gunnar Wrobel from Horde team.. it was found in a code audit (january 2009). It's an old vuln(2009) but still unpublished in exploit-db. There is a lot of vulnerables sites out there. Just try google =) Vuln description: The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition installed on the remote host fails to filter input to the 'driver' argument of the 'Horde_Image::factory' method before using it to include PHP code in 'lib/Horde/Image.php'. Regardless of PHP's 'register_globals' and 'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this issue to view arbitrary files or possibly to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user id. Fix: If using Horde, upgrade to version 3.3.3 / 3.2.4 or later. If using Horde Groupware, upgrade to version 1.2.2 / 1.1.5 or later. If using Horde Groupware Webmail Edition, upgrade to version 1.2.2/1.1.5 or later. PoC: http://www.vulnsite.com/horde/util/barcode.php ?type=../../../../../../../../../../../etc/./passwd%00 # skysbsb [*at*] gmail.com

Referencje:

http://www.securityfocus.com/bid/33491
http://secunia.com/advisories/34609
http://secunia.com/advisories/34418
http://secunia.com/advisories/33695
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://lists.horde.org/archives/announce/2009/000486.html
http://lists.hor2000de.org/archives/announce/2009/000483.html
http://lists.horde.org/archives/announce/2009/000482.html
http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503
http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5
http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top