|
Thursday, 11 August 2005 |
Summary
"SysCP, the System Control Panel is a server administration tool which enables an internet service provider to give their customers a web-based application to administrate their email addresses, their subdomains etc."
By using global variables, attackers can inject code into SysCP and cause it to execute arbitrary code on the system.
Credit:
The information has been provided by Christopher Kunz.
The original article can be found at: http://www.hardened-php.net/advisory_132005.64.html
Details
Vulnerable Systems:
* SysCP version 1.2.10 and prior
Immune Systems:
* SysCP version 1.2.11
With the PHP configuration flag "register_globals On" (which is still the case for a large installation base), a number of variables of SysCP can be injected, leading to the execution of arbitrary remote code, which can also be included from a remote server. This can lead to complete system compromise, and setting backdoors, steal information, or change system settings.
Disclosure Timeline:
18. July 2005 - Initial vendor contact
23. July 2005 - PoC disclosed to vendor
04. August 2005 - Vendor has released updated version
09. August 2005 - public disclosure
|
