[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111121171800.GC18979@foo.fgeek.fi>
Date: Mon, 21 Nov 2011 19:18:00 +0200
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: n0b0d13s@...il.com
Subject: Fwd: Support Incident Tracker <= 3.65 (translate.php) Remote Code
Execution Vulnerability
Can we get CVE assigned for this issue?
Best regards,
Henri Salo
----- Forwarded message from n0b0d13s@...il.com -----
Date: Sat, 19 Nov 2011 15:27:47 GMT
From: n0b0d13s@...il.com
To: bugtraq@...urityfocus.com
Subject: Support Incident Tracker <= 3.65 (translate.php) Remote Code
Execution Vulnerability
X-Mailer: MIME-tools 5.420 (Entity 5.420)
Support Incident Tracker <= 3.65 (translate.php) Remote Code Execution Vulnerability
author...............: Egidio Romano aka EgiX
mail.................: n0b0d13s[at]gmail[dot]com
software link........: http://sitracker.org/
affected versions....: from 3.45 to 3.65
[-] vulnerable code in /translate.php
234. foreach (array_keys($_POST) as $key)
235. {
236. if (!empty($_POST[$key]) AND substr($key, 0, 3) == "str")
237. {
238. if ($lastchar!='' AND substr($key, 3, 1) != $lastchar) $i18nfile .= "\n";
239. $i18nfile .= "\${$key} = '".addslashes($_POST[$key])."';\n";
240. $lastchar = substr($key, 3, 1);
241. $translatedcount++;
242. }
243. }
Input passed via keys of $_POST array isn't properly sanitized before being stored into $i18nfile variable
at line 239, that variable will be the contents of a language file stored into 'i18n' directory with a php
extension. This could allow authenticated users to inject and execute arbitrary PHP code. Furthermore,
access directly to /translate.php?mode=save will reveal the full installation path of the application.
[-] Disclosure timeline:
[13/11/2011] - Vulnerability discovered
[13/11/2011] - Issue reported to http://bugs.sitracker.org/view.php?id=1737
[13/11/2011] - Vendor replied that this issue is fixed in the current SVN trunk
[19/11/2011] - Public disclosure
[-] Proof of concept:
http://www.exploit-db.com/exploits/18132
----- End forwarded message -----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
