Info

Disclosure

Aug 11, 2004

Discovery

Unknown

Dates

Exploit

Aug 11, 2004

Solution

Unknown

Description

YaPiG contains a flaw that allows a remote attacker to execute arbitrary commands. The issue is due to the add_comment.php script not properly sanitizing user input allowing a remote attacker to upload malicious files to the server with a '.php' extension. When the uploaded script is accessed it will be executed with the same privileges as the webserver.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): 'add_comment.php', line 105: Replace: $comments_file= $gid_dir . $gid . "_" . $phid; With: $comments_file= $gid_dir . $gid . "_" . intval($phid); 'functions.php', lines 699-700: Replace: $linea=$linea . $data_array['mail'] . $SEPARATOR; $linea=$linea . $data_array['web'] . $SEPARATOR; With: $linea=$linea . htmlspecialchars($data_array['mail']) . $SEPARATOR; $linea=$linea . htmlspecialchars($data_array['web']) . $SEPARATOR;

Products

NaTaSaB

YaPiG

0.92b

References

Security Tracker: 1010970
Bugtraq ID: 10891
Secunia Advisory ID: 12319
ISS X-Force ID: 16958
Related OSVDB ID: 8658
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0756.html
Vendor Specific Advisory URL: http://sourceforge.net/tracker/index.php?func=detail&aid=1007246&group_id=93674&a ......
Generic Exploit URL: http://www.securityfocus.com/data/vulnerabilities/exploits/yapig_script_injection ......
Vendor URL: http://yapig.sourceforge.net/index.php

Credit

aCiDBiTS - acidbitshotmail.com -

Direct URL: http://osvdb.org/36218