[UNIX] Multiple Vulnerabilities in CoolPHP
From: SecuriTeam (support_at_securiteam.com)
Date: 10/18/04
- Previous message: SecuriTeam: "[NT] Multiple Cross Site Scripting Vulnerabilities in FuseTalk"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 18 Oct 2004 16:16:41 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vulnerabilities in CoolPHP
------------------------------------------------------------------------
SUMMARY
<http://cphp.sourceforge.net/> CoolPHP is a PHP based portal system. It
requires a Web server with PHP support and MySQL. It's compatible with
*NIX and NT.
CoolPHP suffers from multiple vulnerabilities that allow an attacker to
include arbitrary PHP files and perform cross site scripting attacks.
DETAILS
Vulnerable Systems:
* CoolPHP Version 1.0-stable
Cross-Site Scripting vulnerability:
Path Disclosure Vulnerability:
Local file include Vulnerability with Directory Traversal:
Examples:
ADDITIONAL INFORMATION
The information has been provided by <mailto:root@cyberspy.org>
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
====================
DISCLAIMER:
It is possible to construct a link containing arbitrary script code to a
website running CoolPHP. When a user browses the link, the script code
will be executed on the user's
browser. This vulnerability occurs due to insufficient inspection of some
user-supplied input. As a result of this deficiency an attacker may
exploit the vulnerability by creating a specially crafted URL that
includes malicious HTML code as URI parameters for index.php
Examples:
http://example.com/index.php?op=buscar&query=
language=javascript>window.alert(document.cookie);</script>
http://example.com/index.php?op=buscar&query=%3Cscript%20language=
javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
http://example.com/index.php?op=userinfo&nick=
language=javascript>window.alert(document.cookie);</script>
Passing invalid value for the 'op' URI parameter to index.php will cause
an error message to be displayed which contains physical path information.
This information could be useful in further attacks against the system.
Example: http://example.com/cphp/index.php?op=invparam
CoolPHP does not filter dot dot slash (../) sequences from web requests.
This problem may allow an attacker to access arbitrary files outside the
server root
directory and will permit a local attack to include malicious PHP scripts
from another local paths.
http://example.com/index.php?op=../../../../anotheruser/anyfile
Or as URL encoded format:
http://example.com/index.php?op=
%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fanotheruser/anyfile
R00tCr4ck.
The original article can be found at:
<http://www.cyberspy.org/gam/cphp.multiple>
http://www.cyberspy.org/gam/cphp.multiple
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
Relevant Pages
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Windows Graphics Device Interface Integer Overflow Vulnerability ... Exploitation allows an attacker to execute arbitrary code with the ... targeted user to view a specially crafted image file. ...
(Securiteam)
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attacker to point it to mailbox of any registered user in @Mail system. ... Vulnerability 2: SQL database install - Multiple SQL Injection ...
(Securiteam)
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... EMC Legato Networker DoS and Multiple Buffer Overflows ... The vulnerability specifically exists due to improper handling of ... is sent by an attacker, it is possible to overwrite portions of heap ...
(Securiteam)
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IBM Informix Dynamic Server DBLANG Directory Traversal Vulnerability ... Local exploitation of a directory traversal vulnerability in IBM Corp.'s ... attacker can cause set-uid binaries to use Native Language Support ...
(Securiteam)
... Remote exploitation of a Cross-Site Scripting vulnerability in the Roller allows an attacker to force to inject arbitrary script code into a users session, ...
(Bugtraq)
