exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

phpping.txt

phpping.txt
Posted Dec 30, 2003
Authored by ppp-design | Site ppp-design.de

php-ping improperly filters user inputs, allowing for a malicious remote attacker to execute arbitrary commands as the webserver uid.

tags | exploit, remote, arbitrary, php
SHA-256 | eb4c1e1ec0ead88df0513af866db209a8221dfe268483b81a69311c05b77cf3a

phpping.txt

Change Mirror Download
ppp-design found the following design error in php-ping:


Details
-------
Product: php-ping
Affected Version: (no version information included in the script)
Immune Version: latest version
OS affected: all OS with php
Vendor-URL: http://www.theworldsend.net/
Vendor-Status: informed, new version avaiable
Security-Risk: high - very high
Remote-Exploit: Yes


Introduction
------------
php-ping is a simple php script executing the ping command.
Unfortunately a bug allows users to execute arbritary commands.


More details
------------
The problem is based upon the fact that not all user inputs are filtered
correctly. Although $host ist filtered using preg_replace the $count
variable is parsed unfiltered to the system() command.


Proof-of-concept
----------------
You can use one of the following proof of concepts:

http://www.example.com/php-ping.php?count=1+%26+ls%20-l+%26&submit=Ping%21
http://www.example.com/php-ping.php?count=1+%26+cat%20/etc/passwd+%26&submit=Ping%21


Temporary-Fix
-------------
Replace
If ($count > $max_count)
with
If ($count > $max_count || !is_numeric($count))


Fix
---
Use latest version.


Security-Risk
-------------
Because an attacker is able to execute any php command, he is able to
read all files including .htaccess or .htpasswd files or any password
protected pages. Depending on system security he might be able to run
any shell command on the server. That is why we are rating this security
issue to high - very high.


Vendor status
-------------
Unfortunately the webmaster@theworldsend.net address mentioned on the
website and in the script was bouncing. But with help of whois we were
able to find a valid email address to contact the author. On day later,
the bug was fixed without any notice.


Disclaimer
----------
All information that can be found in this advisory is believed to be
true, but maybe it isn't. ppp-design can not be held responsible for the
use or missuse of this information. Redistribution of this text is only
permitted if the text has not been altered and the original author
ppp-design (http://www.ppp-design.de) is mentioned.


This advisory can be found online at:
http://www.ppp-design.de/advisories_show.php?adv=php-ping__executing_arbitrary_commands.txt



--
ppp-design
http://www.ppp-design.de
Public-Key: http://www.ppp-design.de/pgp/ppp-design.asc
Fingerprint: 5B02 0AD7 A176 3A4F CE22 745D 0D78 7B60 B3B5 451A
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close