Signature Detail
Short Name |
HTTP:PHP:PHPSECUREPAGE-RFI |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
phpSecurePages cfgProgDir Parameter Remote File Inclusion |
Release Date |
2013/04/29 |
Update Number |
2258 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: phpSecurePages cfgProgDir Parameter Remote File Inclusion
This signature detects attempts to exploit a known remote file inclusion vulnerability in phpSecurePages. It is due to insufficient validation of user-supplied input. A remote attacker can exploit this by enticing a target to open a malicious URL link. A successful attack can result in arbitrary code execution and loss of sensitive information.
Extended Description
phpSecurePages is a PHP module to secures pages with a login name and password. An input validation error exists that could enable remote users to cause the 'interface.php' script used by phpSecurePages to be loaded from an arbitrary location. The problem occurs when the 'cfgProgPath' variable is submitted as part of query element is submitted as part of a request. As a result, it is possible for a remote user to specify the URL of a site containing a malicious 'interface.php' file as the 'cfgProgPath' variable. This will cause any code in the file to be executed by the checklogin.php script on the site running phpSecurePages, with the privileges of the webserver.
Affected Products
- phpSecurePages 0.11.0 beta
- phpSecurePages 0.12.0 beta
- phpSecurePages 0.13.0 beta
- phpSecurePages 0.14.0 beta
- phpSecurePages 0.15.0 beta
- phpSecurePages 0.16.0 beta
- phpSecurePages 0.17.0 beta
- phpSecurePages 0.18.0 beta
- phpSecurePages 0.19.0 beta
- phpSecurePages 0.20.0 beta
- phpSecurePages 0.21.0 beta
- phpSecurePages 0.22.0 beta
- phpSecurePages 0.23.0 beta
- phpSecurePages 0.24.0 beta
References
- BugTraq: 2970
- CVE: CVE-2001-1468