dotproject <= 2.0.1 remote code execution

[r.verton@xxxxxxxxx]

dotproject <= 2.0.1 remote code execution
======================================

	Software: dotProject <= 2.0.1
   	Severity: Arbitrary code execution, Path/Information Disclosure
   	Risk: High
   	Author: Robin Verton <r.verton@xxxxxxxxx>
   	Date: Feb. 14 2006
   	Vendor: dotproject.net [contacted]

	Description:
	 dotProject is a volunteer supported Project Management application.

	Details:
	 The 'protection.php' script does not properly validate user-supplied input in the 'siteurl' parameter.
	 Some user-supplied input is not checked correctly so an attacker can include a remote php file and
	 execute arbitrary phpcode or arbitrary system command via eval().

	 Because there are over 10 Bugs I only post the vulnerable files + parameters which are not checked.
	 To exploit these vulnerables register_globals have to be set ON (default).

	 1) /includes/db_adodb.php?baseDir=[REMOTE INCLUDE]
 
	 2) /includes/db_connect.php?baseDir=[REMOTE INCLUDE]
 
	 3) /includes/session.php?baseDir=[REMOTE INCLUDE]
	 
	 4) /modules/projects/gantt.php?dPconfig[root_dir]=[REMOTE INCLUDE]
 
	 5) /modules/projects/gantt2.php?dPconfig[root_dir]=[REMOTE INCLUDE]
 
	 6) /modules/projects/vw_files.php?dPconfig[root_dir]=[REMOTE INCLUDE]
 
	 7) /modules/admin/vw_usr_roles.php?baseDir=[REMOTE INCLUDE]
 
	 8) /modules/public/calendar.php?baseDir=[REMOTE INCLUDE]
 
	 9) /modules/public/date_format.php?baseDir=[REMOTE INCLUDE]
 
	 10) /modules/tasks/gantt.php?baseDir=[REMOTE INCLUDE]

	 There are also some path discolsure bugs:

	 Nearly ALL files in /db/ give out some nice php-errors by accessing them directly with the parameter
	 baseDir=foobar.

	 Then, if the /doc/ directory is not deleted (default) you can access to two varoius files which
	 disclose you some system informations:

	 1) /docs/phpinfo.php - A phpinfo() file.
 
	 2) /docs/check.php - Some more informations about the installed dotProject.

	Solution:
	 Turn register_globals OFF, delete the /docs/ dir and cover /db/ dir with an htaccess.

	Timeline:
	 24.01.2006 - Bugs found
	 26.01.2006 - Vendor Contacted
	 14.02.2006 - Publishing

	Credits:
	 Credits go to Robin Verton (r.verton [at] gmail [dot] com)