Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27266
HistoryNov 06, 2011 - 12:00 a.m.

phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection Exploit

2011-11-0600:00:00
vulners.com
31
JSON

phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection Exploit

author…: EgiX
mail…: n0b0d13s[at]gmail[dot]com
software link…: http://phpldapadmin.sourceforge.net/
affected versions…: from 1.2.0 to 1.2.1.1

[-] vulnerable code in /lib/functions.php

  1. function masort(&$data,$sortby,$rev=0) {
  2.    if &#40;defined&#40;&#39;DEBUG_ENABLED&#39;&#41; &amp;&amp; DEBUG_ENABLED &amp;&amp; &#40;&#40;$fargs=func_get_args&#40;&#41;&#41;||$fargs=&#39;NOARGS&#39;&#41;&#41;

  3.        debug_log&#40;&#39;Entered &#40;&#37;&#37;&#41;&#39;,1,0,__FILE__,__LINE__,__METHOD__,$fargs&#41;;

  5.    # if the array to sort is null or empty

  6.    if &#40;! $data&#41; return;

  8.    static $CACHE = array&#40;&#41;;

  10.    if &#40;empty&#40;$CACHE[$sortby]&#41;&#41; {

  11.        $code = &quot;&#92;$c=0;&#92;n&quot;;

  13.        foreach &#40;explode&#40;&#39;,&#39;,$sortby&#41; as $key&#41; {

  14.            $code .= &quot;if &#40;is_object&#40;&#92;$a&#41; || is_object&#40;&#92;$b&#41;&#41; {&#92;n&quot;;

  16.            $code .= &quot;    if &#40;is_array&#40;&#92;$a-&gt;$key&#41;&#41; {&#92;n&quot;;

  17.            $code .= &quot;        asort&#40;&#92;$a-&gt;$key&#41;;&#92;n&quot;;

  18.            $code .= &quot;        &#92;$aa = array_shift&#40;&#92;$a-&gt;$key&#41;;&#92;n&quot;;

…

  1.        $code .= &#39;return $c;&#39;;

  3.        $CACHE[$sortby] = create_function&#40;&#39;$a, $b&#39;,$code&#41;;

  4.    }

The $sortby parameter passed to 'masort' function isn't properly sanitized before being used in a call to create_function()
at line 1080, this can be exploited to inject and execute arbitrary PHP code. The only possible attack vector is when handling
the 'query_engine' command, here input passed through $_REQUEST['orderby'] is passed as $sortby parameter to 'masort' function.

[-] Disclosure timeline:

[30/09/2011] - Vulnerability discovered
[02/10/2011] - Issue reported to http://sourceforge.net/support/tracker.php?aid=3417184
[05/10/2011] - Fix committed: http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;h=76e6dad
[23/10/2011] - Public disclosure

[-] Proof of concept:

http://www.exploit-db.com/exploits/18021/

JSON