PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Vulnerability

2011-11-2700:00:00

vulners.com

JSON

PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Vulnerability

author…: Egidio Romano aka EgiX
mail…: n0b0d13s[at]gmail[dot]com
software link…: http://www.pmwiki.org/
affected versions…: from 2.0.0 to 2.2.34

[-] vulnerable code in PageListSort() function defined into /scripts/pagelist.php

```
 $code = &#39;&#39;;
```

 foreach&#40;$opt[&#39;=order&#39;] as $o =&gt; $r&#41; {

```
   if &#40;@$PageListSortCmp[$o]&#41; 
```

     $code .= &quot;&#92;$c = {$PageListSortCmp[$o]}; &quot;;

```
   else 
```

     $code .= &quot;&#92;$c = @strcasecmp&#40;&#92;$PCache[&#92;$x][&#39;$o&#39;],&#92;$PCache[&#92;$y][&#39;$o&#39;]&#41;; &quot;;

   $code .= &quot;if &#40;&#92;$c&#41; return $r&#92;$c;&#92;n&quot;;

```
 }
```

 StopWatch&#40;&#39;PageListSort sort&#39;&#41;;

```
 if &#40;$code&#41; 
```
```
   uasort&#40;$list,
```

          create_function&#40;&#39;$x,$y&#39;, &quot;global &#92;$PCache; $code return 0;&quot;&#41;&#41;;

 StopWatch&#40;&#39;PageListSort end&#39;&#41;;

Input passed through 'order' parameter of 'pagelist' directive isn't properly sanitized before being used
in a call to create_function() at line 463. This can be exploited to inject and execute arbitrary PHP code.
Successful exploitation of this vulnerability might require authentication if the wiki isn't public writable.

[-] Disclosure timeline:

[09/11/2011] - Vulnerability discovered
[11/11/2011] - Issue reported to http://www.pmwiki.org/wiki/PITS/01271
[11/11/2011] - Version 2.2.35 released: http://www.pmwiki.org/wiki/PmWiki/ChangeLog#v2235
[12/11/2011] - CVE number requested
[15/11/2011] - Assigned CVE-2011-4453
[23/11/2011] - Public disclosure

[-] Proof of concept:

http://www.exploit-db.com/exploits/18149