what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

XAMPP 1.8.1 Local Write Access

XAMPP 1.8.1 Local Write Access
Posted Sep 26, 2013
Authored by Manuel Garcia Cardenas | Site isecauditors.com

XAMPP version 1.8.1 allows an unprivileged user the ability to write to the local disk.

tags | exploit, local
advisories | CVE-2013-2586
SHA-256 | 4d1631d6f469e4eec20739ed04366120ee8ad777df5da5df3840c88f67f32135

XAMPP 1.8.1 Local Write Access

Change Mirror Download
=============================================
INTERNET SECURITY AUDITORS ALERT 2013-007
- Original release date: March 14th, 2013
- Last revised: March 19th, 2013
- Discovered by: Manuel García Cárdenas
- Severity: 6,8/10 (CVSS Base Score)
- CVE-ID: CVE-2013-2586
=============================================

I. VULNERABILITY
-------------------------
XAMPP 1.8.1 Local Write Access Vulnerability

II. BACKGROUND
-------------------------
XAMPP is a free and open source cross-platform web server solution stack
package, consisting mainly of the Apache HTTP Server, MySQL database, and

interpreters for scripts written in the PHP and Perl programming languages.

III. DESCRIPTION
-------------------------
It has been detected than an unprivileged user can write in the local
disk and the local file "lang.tmp" can be modified in the remote machine.

The injection is done through the page "/xampp/lang.php".

IV. PROOF OF CONCEPT
-------------------------
Malicious Request

http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk

And next, if we access to the file:

http://vulnerablesite.com/xampp/lang.tmp

We can verify that the file was modified.

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as user
credentials,

personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
XAMPP 1.8.1

VII. SOLUTION
-------------------------
All data received by the application that can be modified by the user
must be validated.

VIII. REFERENCES
-------------------------
http://www.apachefriends.org
http://www.isecauditors.com

IX. CREDITS
-------------------------
This vulnerability has been discovered
by Manuel García Cárdenas (mgarcia (at) isecauditors (dot) com).

X. REVISION HISTORY
------------------------
March 14, 2013: Initial release
September 26, 2013: Final release

XI. DISCLOSURE TIMELINE
-------------------------
March 14, 2013: Vulnerability acquired by Internet Security
Auditors (www.isecauditors.com).
March 16, 2013: CVE-ID received.
March 18, 2013: Sent to Development Manager.
August 30, 2013: New version that includes patched code.
September 26, 2013: Sent to lists.


XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Internet
Security

Auditors accepts no responsibility for any damage caused by the use or
misuse of this information.

XIII. ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and

assessing. Our clients include some of the largest companies in areas
such as finance, telecommunications, insurance, ITC, etc. We are vendor
independent

provider with a deep expertise since 2001. Our efforts in R&D include
vulnerability research, open security project collaboration and
whitepapers,

presentations and security events participation and promotion. For
further information regarding our security services, contact us.

XIV. FOLLOW US
-------------------------
You can follow Internet Security Auditors, news and security advisories at:
https://www.facebook.com/ISecAuditors
https://twitter.com/ISecAuditors
http://www.linkedin.com/company/internet-security-auditors
http://www.youtube.com/user/ISecAuditors
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close