Bugtraq mailing list archives
Arbitrary code execution in eping plugin
From: y0int () yahoo it
Date: 9 Jun 2005 16:17:43 -0000
www.RedC0de.org found the following error in eping: Details ------- Advisory name: Arbitrary code execution in eping plugin Advisory number: 1 Application: eping Aplication author: apnovi3 Security-Risk: high - very high Remote-Exploit: Yes Discovered by: m00fd1 aka Tr|p Introduction ------------ Eping is a simple php script executing the ping command, eping is an plugin for e107 portal system. Unfortunately a bug allows users to execute arbritary commands. More details ------------ The problem is based upon the fact that not all user inputs are filtered correctly. Variable $eping_host is not filtered using preg_replace. Proof of concept ---------------- You must put an evil code in $eping_host variable... Example: ?eping_host=127.0.0.1;ls... ?eping_host=127.0.0.1;cd%20/;cat%20/etc/passwd... Security-Risk ------------- Because an attacker is able to execute any php command, he is able to read all files including .htaccess or .htpasswd files or any password protected pages. Depending on system security he might be able to run any shell command on the server. That is why we are rating this security issue to high - very high.
Current thread:
- Arbitrary code execution in eping plugin y0int (Jun 09)
- Re: Arbitrary code execution in eping plugin Oliver Monneke (Jun 13)
- Re: Arbitrary code execution in eping plugin Jonathan Angliss (Jun 14)
- Re: Arbitrary code execution in eping plugin Christoph 'knurd' Jeschke (Jun 14)
- Re: Arbitrary code execution in eping plugin Anders Henke (Jun 15)
- Re: Arbitrary code execution in eping plugin Jonathan Angliss (Jun 14)
- Re: Arbitrary code execution in eping plugin Oliver Monneke (Jun 13)
- <Possible follow-ups>
- Re: Arbitrary code execution in eping plugin oliver (Jun 11)
- Re: Arbitrary code execution in eping plugin Sam Michaels (Jun 13)
- Re: Arbitrary code execution in eping plugin exon (Jun 13)