A vulnerability has been discovered in the popular E-Commerce package 'phpShop'. The vulnerability's details are available in the attached advisory, or at http://www.fribble.net/advisories/phpshop_29-04-04.txt Due to the nature of this vulnerability, I notified the lead programmer for this package over a week ago, and no reply or patch has yet been released. Once again, this unfortunately another PHP package falling victim to the 'register globals substitution' vulnerability that many other high- profile packages have had (phpNuke, phpBB, just to name a couple). When will people learn that replacing one bad configuration error with a (even worse!) programming one is NOT the way to migrate into new versions of PHP. Regards, Calum Power - Cultural Jammer - Security Enthusiast - Hopeless Cynic enune@xxxxxxx http://www.fribble.net
-------------- 29/04/2004 -------------- Security Advisory - Arbitrary code inclusion vulnerability in phpShop Discovered by: Calum Power [Enune] Advisory Date: 29/04/2004 Versions Affected: <= 0.7.1 Unaffected versions: None Known (Developer contacted 29/04/04) Product Description: (From product website) phpShop is a PHP-based e-commerce application and PHP development framework. phpShop offers the basic features needed to run a successful e-commerce web site and to extend its capabilities for multiple purposes. Summary: Under certain circumstances, it may be possible to execute arbitrary code in the context of the web server. Details: If PHP is configured (in php.ini, or otherwise) to have register_globals turned off, and the PHP version is above or equal to 4.1, then a phpShop installation will initiate a 'fix' to register all the globals in the HTTP_REQUEST into local variables. One of these variables is the '$base_dir' variable, which is used to declare the base directory of the phpshop installation. If the aforementioned events are triggered (as in most recent default PHP installations), it is possible to overwrite the $base_dir variable (in a GET, POST or COOKIE declaration), and taint the many lines of code from 'htdocs/index.php UPDATE(9/05): It has been discovered that ANY version of PHP with register_globals turned off would be vulnerable to exploit. Exploit: An attacker would only need to create a file called 'phpshop.cfg' on his or her webserver in a directory called 'etc', and craft the base_dir variable to include the code from his webserver, and the phpShop will include this code into it's page, assuming that the attacker's script is the configuration for the phpShop. It is then possible for the attacker to take control over the website and/or server, and perform malicious activities at will. Impact: The impact of this vulnerability could be quite devastating for some companies, who rely on the security of packages such as phpShop to run their businesses online. The ramifications could be things such as the redirection of deliveries to customers to an address the attacker controls, or the hijacking of Credit Card details. Thanks: Greets to Mjec on freenode.net#php, rAchel from IdleThink, the guys at Phrack, and DI Michael Grant from the Tasmanian Fraud Investigation Squad. Censorship r0x my s0x.
