PNGƒJƒEƒ“ƒ^+—pƒƒO‰ƒXƒNƒŠƒvƒg remote commands execution vulnerability

blahplok_at_yahoo.com
Date: 07/07/05

  • Next message: pjphem_at_mybox.it: "SimplePHPBlog 0.4.0 <= Remote Password Disclosure" 
    Date: 7 Jul 2005 14:02:21 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is) PNG&#402;J&#402;E&#402;&#8220;&#402;^+&#8212;p&#402;&#402;O&#8240;&#402;X&#402;N&#402;&#352;&#402;v&#402;g remote commands execution vulnerability

    Vendor URL : http://www.aurora.dti.ne.jp/~zom/Counter/
    Vulnerability : Remote Command Execution
    Risk : High

    ==================================================================
    An attacker may exploit this vulnerability to execute commands on
    the remote host by adding special parameters to Kaiseki.cgi script.

    Problem:

    There is no filtering special character when open file in sub ReadLog.
    Vulnerable code :

    sub ReadLog
    {
    .......
    .......

            $imaLog = $$log;
            if(!open(IN, "./$main::logdir/$imaLog"))
            {
    .......
    .......
    }

    Fix :

    add :
    $$log =~ s/[;<>\*\|'&\$!?#\(\)\[\]\{\}:'"\\]//go;

    before :
    $imaLog = $$log;
    if(!open(IN, "./$main::logdir/$imaLog"))
    {
    .....
    }

    Example exploitasion :

    http://[target]/cgi-bin/kaiseki.cgi?file.exetension|command|
    or
    http://[target]/cgi-bin/kaiseki.cgi?|command|

    June 2005 : bug found
    July 7 2005 : vendor contact
    July 7 2005 : Vendor respon
    July 2005 : ----------

    ==================================================================

    by blahplok

  • Next message: pjphem_at_mybox.it: "SimplePHPBlog 0.4.0 <= Remote Password Disclosure"

    Relevant Pages