Search...

openSIS 5.2 PHP Code Injection Vulnerability

2013-12-08T00:00:00
ID 1337DAY-ID-21638
Type zdt
Reporter EgiX
Modified 2013-12-08T00:00:00

Description

openSIS versions 4.5 through 5.2 suffer from a remote PHP code injection vulnerability.

                                        
                                            ----------------------------------------------------------
openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability
----------------------------------------------------------


[-] Software Link:

http://www.opensis.com/


[-] Affected Versions:

All versions from 4.5 to 5.2.


[-] Vulnerability Description:

The vulnerable code is located in the /ajax.php script:

86.  if(clean_param($_REQUEST['modname'],PARAM_NOTAGS))
87.  {
88.    if($_REQUEST['_openSIS_PDF']=='true')
89.      ob_start();
90.    if(strpos($_REQUEST['modname'],'?')!==false)
91.    {
92.      $vars = substr($_REQUEST['modname'],(strpos($_REQUEST['modname'],'?')+1));
93.      $modname = substr($_REQUEST['modname'],0,strpos($_REQUEST['modname'],'?'));
94.  
95.      $vars = explode('?',$vars);
96.      foreach($vars as $code)
97.      {
98.        $code = decode_unicode_url("\$_REQUEST['".str_replace('=',"']='",$code)."';");
99.        eval($code);
100.      }
101.    }

User input passed through the "modname" request variable is not properly sanitized before being used in
a call to the eval() function at line 99. This can be exploited to inject and execute arbitrary PHP code.


[-] Solution:

As of December 5th, 2013 the only solution is this patch: http://sourceforge.net/p/opensis-ce/code/1009


[-] Disclosure Timeline:

[04/12/2012] - Issue reported to http://sourceforge.net/p/opensis-ce/bugs/59/
[28/12/2012] - Vendor contacted, replied that the next version will fix the issue
[12/01/2013] - CVE number requested
[14/01/2013] - CVE number assigned
[26/04/2013] - Version 5.2 released, however the issue isn't fixed yet
[12/05/2013] - Vendor contacted again
[15/05/2013] - Issue temporarily fixed in the SVN repository (r1009)
[04/12/2013] - After one year still no official solution available


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1349 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.

#  0day.today [2018-04-08]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2017
Protected by