[phpldapadmin] [ phpldapadmin-Bugs-3417184 ] PHP Code Injection Vulnerability

Bugs item #3417184, was opened at 2011-10-02 19:27
Message generated for change (Comment added) made by gruberroland
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3417184&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 9
Private: No
Submitted By: EgiX ()
Assigned to: Nobody/Anonymous (nobody)
Summary: PHP Code Injection Vulnerability

Initial Comment:
Hi guys,
I've found a critical security vulnerability into /lib/functions.php
The vulnerable function is "masort", look at the code: http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blob;f=lib/functions.php;#l1002
The $sortby parameter isn't properly sanitized before being used in a call to "create_function()" at line 1080, this can be exploited to inject and execute arbitrary PHP code.

----------------------------------------------------------------------

Comment By: Roland Gruber (gruberroland)
Date: 2011-10-02 20:20

Message:
I think the whole "create_function" should be replaced with normal PHP
code. Dynamic creation of code is always a risk.
This is why I submitted a patch to remove all eval() calls.


A quick fix could look like this:

		foreach (explode(',',$sortby) as $key) {
			if (!preg_match('/^[a-zA-z0-9_]+$/', $key)) {
				die();
			}


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3417184&group_id=61828

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security
threats, fraudulent activity, and more. Splunk takes this data and makes
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2dcopy2
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/