[phpldapadmin] [ phpldapadmin-Bugs-3417184 ] PHP Code Injection Vulnerability

Bugs item #3417184, was opened at 2011-10-03 04:27
Message generated for change (Comment added) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3417184&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Pending
>Resolution: Invalid
Priority: 9
Private: No
Submitted By: EgiX ()
Assigned to: Nobody/Anonymous (nobody)
Summary: PHP Code Injection Vulnerability

Initial Comment:
Hi guys,
I've found a critical security vulnerability into /lib/functions.php
The vulnerable function is "masort", look at the code: http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blob;f=lib/functions.php;#l1002
The $sortby parameter isn't properly sanitized before being used in a call to "create_function()" at line 1080, this can be exploited to inject and execute arbitrary PHP code.

----------------------------------------------------------------------

>Comment By: Deon George (wurley)
Date: 2011-10-05 23:23

Message:
Can you provide a working example?

----------------------------------------------------------------------

Comment By: Roland Gruber (gruberroland)
Date: 2011-10-03 05:20

Message:
I think the whole "create_function" should be replaced with normal PHP
code. Dynamic creation of code is always a risk.
This is why I submitted a patch to remove all eval() calls.


A quick fix could look like this:

		foreach (explode(',',$sortby) as $key) {
			if (!preg_match('/^[a-zA-z0-9_]+$/', $key)) {
				die();
			}


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3417184&group_id=61828

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/