PHP Live Helper <= 2.0.1 Multiple Vulnerabilities

2008.08.19
Credit: GulfTech
Risk: High
Local: No
Remote: Yes

########################################################## # GulfTech Security Research August 16, 2008 ########################################################## # Vendor : Turnkey Web Tools, Inc # URL : http://www.turnkeywebtools.com # Version : PHP Live Helper <= 2.0.1 # Risk : Multiple Vulnerabilities ########################################################## Description: PHP Live Helper is an online support system written in php that allows the visitors of a website to interact in real time with the site owners. There are a number of issues in PHP Live Helper that allow for several different attacks such as SQL Injection, Variable Overwriting, and remote code execution. The issues require no authentication to exploit, and users are encouraged to upgrade as soon as possible. SQL Injection: There are a number of SQL Injection issues in PHP Live Helper that allow for an attacker to have arbitrary access to database contents such as administrator credentials. First, let's have a look at global.php &#64; lines 51-60 function get ($table, $id, $from="id") { $result=$this->DB_site->query_first("SELECT * FROM ". $this->dbprefix.$table." where ".$from."='$id'"); if (is_array($result)) { foreach ($result as $key => $val) { $info[$key] = stripslashes($val); } } return $info; } As we can see in the above code, all of the parameters passed to the get() function are unsanitized. So, if the data is not sanitized before being sent to get() we have an SQL Injection issue. /onlinestatus_html.php?dep=-99' UNION SELECT 1,2,3,4,5,6,7,8 FROM admin_accounts WHERE id=1 AND MID(password,1,1)=concat(char(50))/* An example of the vulnerable function being called can be seen in onlinestatus_html.php &#64; line 19&#46; As a result a url like the one above can be used to enumerate the admin password for the PHP Live Helper installation. If there is a match to the specified character you will see an sql error, otherwise you will see an image file. Arbitrary Variable Overwriting: PHP Live Helper is vulnerable to a limited Variable Overwriting issue due to some faulty register globals emulation code. The vulnerable code in question can be found at libsecure.php &#64; lines 400-414 unset ($_GET[abs_path]); $rg = ini_get ('register_globals'); $getget_count = &#64;count ($_GET); $getget_keys = &#64;array_keys ($_GET); for ($i = 0; $i < $getget_count; ++$i) { $getget_name = $getget_keys[$i]; $getget_value = $_GET[$getget_keys[$i]]; $_GET[$getget_name] = strip_tags (urldecode ($getget_value)); if ($rg == 1) { $$getget_name = strip_tags (urldecode ($getget_value)); continue; } } The above code shows that variables can be overwritten, but because of where it is called, only variables from within the db config file can be overwritten (database info, and language file setting). This is enough though to allow an attacker to execute arbitrary code on the server by overwriting the table prefix variable with an arbitrary SQL query in order to gather the location of report files, and then overwriting the language file so that the report containing the malicious php code is included and executed. The odd thing is that this registers global emulation code is only called when register globals is already on, so it is kind of pointless. Arbitrary Code Execution: A different bit of code is set to run when register globals are off. The code in question is located in /includes/globalsoff.php and attempts to emulate register gloabls by recursively creating variables based on the GPC super globals. The problem is that all of the variable creation is done using eval() and thus allows for remote code execution. /chat.php?rg=0&test=";phpinfo();exit;// A url like the one shown above will successfully execute the specified arbitrary php code. It should be noted that by setting rg=0 an attacker can have this code ran regardless of register globals settings since if globals is on you can influence the "rg" parameter, and if it is off, the script runs as intended. Solution: The TurnKeyWebTools developers have addressed these issues in the latest version of PHP Live Helper which can be found at the following url. http://www.turnkeywebtools.com/esupport/index.php?_m=news&_a=viewnews&newsid=62 Credits: James Bercegay of the GulfTech Security Research Team Related Info: The original advisory can be found at the following location http://www.gulftech.org/?node=research&article_id=00124-08162008

References:

http://www.securityfocus.com/bid/30729
http://www.securityfocus.com/archive/1/archive/1/495542/100/0/threaded
http://www.milw0rm.com/exploits/6261
http://www.gulftech.org/?node=research&article_id=00124-08162008
http://secunia.com/advisories/31521


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top