PHP-Nuke Network Tools执行服务器命令漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106520 漏洞类型 未知
发布时间 2001-11-16 更新时间 2005-09-14
CVE编号 CVE-2001-0899 CNNVD-ID CNNVD-200111-014
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/21155
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200111-014
|漏洞详情
PHP-Nuke的NetworkTools0.2版本存在漏洞。远程攻击者可以借助$hostinput变量的shell元字符执行服务器命令。
|漏洞EXP
source: http://www.securityfocus.com/bid/3552/info

Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interface.

A problem with the package has been discovered that could allow remote users to gain arbitrary access to restricted resources. The problem is in the filtering of metacharacters by the interface. A command passed to the modules in the suite could be encapsulated in metacharacters, and would result in the command being executed on the system with the permissions of the httpd process.

This makes it possible for a remote user to execute arbitrary commands, and potentially gain access to a vulnerable host. 

Asking the Php script for Pinging, Nmap, or traceroute this kind of adresse
<www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server.
|参考资料

来源:phpnukerz.org
链接:http://phpnukerz.org/modules.php?name=Downloads&d_op=viewsdownload&sid=32
来源:BUGTRAQ
名称:20011116NetworkTool0.2AddonforPHPNukevulnerabletoremotecommandexecution
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=100593523104176&w=2
来源:phpnukerz.org
链接:http://phpnukerz.org/modules.php?name=Downloads&d_op=viewsdownload&sid=32
来源:XF
名称:phpnuke-nettools-command-execution(7578)
链接:http://xforce.iss.net/xforce/xfdb/7578