PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Vulnerability

2011-11-27T00:00:00
ID SECURITYVULNS:DOC:27355
Type securityvulns
Reporter Securityvulns
Modified 2011-11-27T00:00:00

Description


PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Vulnerability

author...............: Egidio Romano aka EgiX mail.................: n0b0d13s[at]gmail[dot]com software link........: http://www.pmwiki.org/ affected versions....: from 2.0.0 to 2.2.34

[-] vulnerable code in PageListSort() function defined into /scripts/pagelist.php

  1. $code = '';
  2. foreach($opt['=order'] as $o => $r) {
  3. if (@$PageListSortCmp[$o])
  4. $code .= "\$c = {$PageListSortCmp[$o]}; ";
  5. else
  6. $code .= "\$c = @strcasecmp(\$PCache[\$x]['$o'],\$PCache[\$y]['$o']); ";
  7. $code .= "if (\$c) return $r\$c;\n";
  8. }
  9. StopWatch('PageListSort sort');
  10. if ($code)
  11. uasort($list,
  12. create_function('$x,$y', "global \$PCache; $code return 0;"));
  13. StopWatch('PageListSort end');

Input passed through 'order' parameter of 'pagelist' directive isn't properly sanitized before being used in a call to create_function() at line 463. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability might require authentication if the wiki isn't public writable.

[-] Disclosure timeline:

[09/11/2011] - Vulnerability discovered [11/11/2011] - Issue reported to http://www.pmwiki.org/wiki/PITS/01271 [11/11/2011] - Version 2.2.35 released: http://www.pmwiki.org/wiki/PmWiki/ChangeLog#v2235 [12/11/2011] - CVE number requested [15/11/2011] - Assigned CVE-2011-4453 [23/11/2011] - Public disclosure

[-] Proof of concept:

http://www.exploit-db.com/exploits/18149