0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Concrete5 5.7.3.1 sendmail Remote Code Execution Vulnerability
[-------------------------------------------------------------------
Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability
-------------------------------------------------------------------
[-] Software Link:
https://www.concrete5.org/
[-] Affected Versions:
Version 5.7.3.1 and probably other versions.
[-] Vulnerability Description:
The vulnerable code is located in /concrete/controllers/single_page/dashboard/system/registration/open.php:
21. switch ($this->post('registration_type')) {
22. case "enabled":
23. Config::save('concrete.user.registration.enabled', true);
24. Config::save('concrete.user.registration.validate_email', false);
25. Config::save('concrete.user.registration.approval', false);
26. Config::save('concrete.user.registration.notification', $this->post('register_notification'));
27. Config::save(
28. 'concrete.user.registration.notification_email',
29. Loader::helper('security')->sanitizeString(
30. $this->post('register_notification_email')));
31. break;
User input passed through the "register_notification_email" POST parameter is not properly sanitized before
being stored into a configuration setting at lines 27-30 (the sanitizeString() method doesn’t check if it is
a valid email address). This value is used as a sender email address to send out a notification email when a
new user is being registered, and this is done using the PHP mail() function, specifically passing such value
to its fifth parameter. So, when sendmail is used to send out such an email, it is possible to alter the
command line and tell the sendmail program to log all the email traffic in an arbitrary file chosen by the
attacker, resulting in an arbitrary PHP code execution. This vulnerability is mitigated by the fact that it
can be exploited only by authenticated administrator users (even though it could be exploited via a Cross-Site
Request Forgery attack as well) and only if the email is being sent with sendmail.
[-] Solution:
Update to version 5.7.4 or later.
[-] Disclosure Timeline:
[05/05/2015] - Vulnerability details sent through HackerOne
[05/05/2015] - Vendor said a patch has been committed and will be available in the next version
[07/05/2015] - Version 5.7.4 released along with the patch for this vulnerability
[06/06/2015] - Vulnerability publicly disclosed on HackerOne
[11/06/2014] - CVE number requested
[11/06/2014] - Publication of this advisory
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a name to this vulnerability yet.
[-] Credits:
Vulnerability discovered by Egidio Romano of Minded Security.
# 0day.today [2024-10-06] #