扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 |
============================================= INTERNET SECURITY AUDITORS ALERT 2013-007 - Original release date: March 14th, 2013 - Last revised:March 19th, 2013 - Discovered by: Manuel García Cárdenas - Severity: 6,8/10 (CVSS Base Score) - CVE-ID: CVE-2013-2586 ============================================= I. VULNERABILITY ------------------------- XAMPP 1.8.1 Local Write Access Vulnerability II. BACKGROUND ------------------------- XAMPP is a free and open source cross-platform web server solution stack package, consisting mainly of the Apache HTTP Server, MySQL database, and interpreters for scripts written in the PHP and Perl programming languages. III. DESCRIPTION ------------------------- It has been detected than an unprivileged user can write in the local disk and the local file "lang.tmp" can be modified in the remote machine. The injection is done through the page "/xampp/lang.php". IV. PROOF OF CONCEPT ------------------------- Malicious Request http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk And next, if we access to the file: http://vulnerablesite.com/xampp/lang.tmp We can verify that the file was modified. V. BUSINESS IMPACT ------------------------- An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal sensitive information as user credentials, personal data, etc. VI. SYSTEMS AFFECTED ------------------------- XAMPP 1.8.1 VII. SOLUTION ------------------------- All data received by the application that can be modified by the user must be validated. VIII. REFERENCES ------------------------- http://www.apachefriends.org http://www.isecauditors.com IX. CREDITS ------------------------- This vulnerability has been discovered by Manuel García Cárdenas (mgarcia (at) isecauditors (dot) com). X. REVISION HISTORY ------------------------ March 14, 2013: Initial release September 26, 2013: Final release XI. DISCLOSURE TIMELINE ------------------------- March14, 2013: Vulnerability acquired by Internet Security Auditors (www.isecauditors.com). March16, 2013: CVE-ID received. March18, 2013: Sent to Development Manager. August 30, 2013: New version that includes patched code. September 26, 2013: Sent to lists. XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information. XIII. ABOUT ------------------------- Internet Security Auditors is a Spain based leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us. XIV. FOLLOW US ------------------------- You can follow Internet Security Auditors, news and security advisories at: https://www.facebook.com/ISecAuditors https://twitter.com/ISecAuditors http://www.linkedin.com/company/internet-security-auditors http://www.youtube.com/user/ISecAuditors |
体验盒子
