Shop-Script FREE Security Bypass and PHP Code Execution

Posted on Tuesday, September 18, 2007 @ 12:17:58 PDT in Security
by Raven

SECUNIA ADVISORY ID: SA26840

VERIFY ADVISORY: http://secunia.com/advisories/26840/

CRITICAL: Highly critical

IMPACT: Security Bypass, System access

WHERE: >From remote

SOFTWARE:
Shop-Script FREE 1.x - http://secunia.com/product/15759/
Shop-Script FREE 2.x - http://secunia.com/product/15760/

DESCRIPTION: Raz0r has discovered some vulnerabilities in Shop-Script FREE, which can be exploited by malicious people to bypass certain security restrictions and compromise a vulnerable system.

1) The admin.php script does not properly restrict access to logged in users and can be exploited with an HTTP client that does not follow redirects.

2) Input passed to the "colscount", "darkcolor", and "productscount" parameters in admin.php is not properly sanitised before it is written to the cfg/appearence.inc.php file which is included by the index.php script. This can be exploited to execute arbitrary PHP code.

Successful exploitation of this vulnerability requires valid administrator credentials (but see vulnerability #1). The vulnerabilities are confirmed in version 2.0 and reported in version 1.2. Other versions may also be affected.

SOLUTION: Restrict access to the "admin.php" script (e.g. with ".htaccess").

PROVIDED AND/OR DISCOVERED BY: Raz0r

ORIGINAL ADVISORY: http://milw0rm.com/exploits/4419
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 352,772,481
  • Today: 16,321
Server InfoServer Info
  • Apr 22, 2018
  • 05:39 am PDT
 
 

Daily Inspiration