WARNING! Fake news / Disputed / BOGUS

dotproject <= 2.0.1 remote code execution

2006.02.16
Credit: Robin Verton
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

dotproject <= 2.0.1 remote code execution ====================================== Software: dotProject <= 2.0.1 Severity: Arbitrary code execution, Path/Information Disclosure Risk: High Author: Robin Verton <r.verton (at) gmail (dot) com [email concealed]> Date: Feb. 14 2006 Vendor: dotproject.net [contacted] Description: dotProject is a volunteer supported Project Management application. Details: The 'protection.php' script does not properly validate user-supplied input in the 'siteurl' parameter. Some user-supplied input is not checked correctly so an attacker can include a remote php file and execute arbitrary phpcode or arbitrary system command via eval(). Because there are over 10 Bugs I only post the vulnerable files + parameters which are not checked. To exploit these vulnerables register_globals have to be set ON (default). 1) /includes/db_adodb.php?baseDir=[REMOTE INCLUDE] 2) /includes/db_connect.php?baseDir=[REMOTE INCLUDE] 3) /includes/session.php?baseDir=[REMOTE INCLUDE] 4) /modules/projects/gantt.php?dPconfig[root_dir]=[REMOTE INCLUDE] 5) /modules/projects/gantt2.php?dPconfig[root_dir]=[REMOTE INCLUDE] 6) /modules/projects/vw_files.php?dPconfig[root_dir]=[REMOTE INCLUDE] 7) /modules/admin/vw_usr_roles.php?baseDir=[REMOTE INCLUDE] 8) /modules/public/calendar.php?baseDir=[REMOTE INCLUDE] 9) /modules/public/date_format.php?baseDir=[REMOTE INCLUDE] 10) /modules/tasks/gantt.php?baseDir=[REMOTE INCLUDE] There are also some path discolsure bugs: Nearly ALL files in /db/ give out some nice php-errors by accessing them directly with the parameter baseDir=foobar. Then, if the /doc/ directory is not deleted (default) you can access to two varoius files which disclose you some system informations: 1) /docs/phpinfo.php - A phpinfo() file. 2) /docs/check.php - Some more informations about the installed dotProject. Solution: Turn register_globals OFF, delete the /docs/ dir and cover /db/ dir with an htaccess. Timeline: 24.01.2006 - Bugs found 26.01.2006 - Vendor Contacted 14.02.2006 - Publishing Credits: Credits go to Robin Verton (r.verton [at] gmail [dot] com)


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top