netVigilance Security Advisory 3

Arbitrary File Disclosure Vulnerability in phpGedView 2.65.1 and prior

Description:
Directory traversal vulnerability in editconfig_gedcom.php for phpGedView 2.65.1 and earlier allows remote attackers to read arbitrary files or execute arbitrary PHP programs on the server via .. (dot dot) sequences in the gedcom_config parameter.

External References:
Mitre CVE: CAN-2004-0127
BUGTRAQ: 20040129 PHP Code Injection Vulnerabilities in phpGedView 2.65.1 and prior

Summary:
phpGedView is an open source system for online viewing of Gedcom information (family tree and genealogy information). Multiple PHP Code Injection vulnerabilities exist in the phpGedView product. They enable a malicious user to access any file on the server.

Release Date:
January 29 2004

Severity:
High

SecureScout Testcase ID:
TC 17867 (released Feb 6th)

Vulnerable Systems:
phpGedView version 2.65.1 and prior

Vulnerability Type:
Directory Traversal - Allowing the Attacker to read any file on the Target Server via the .. (dot dot) Sequence.

Vendor Status:
The Vendor has been notified and has Released a Version 2.65.3 that fixes the problem

Example:
(HIGH Risk BUT user must be Admin)

- -- HTTP Request --

http://[target]/[phpGedView-directory]/editconfig_gedcom.php?gedcom_config=../../../../../../etc/passwd
or
http://[target]/[phpGedView-directory]/editconfig_gedcom.php
POSTDATA: gedcom_config=../../../../../../etc/passwd

- -- HTTP Request --

Code impacted : editconfig_gedcom.php

61:if (empty($gedcom_config)) {
62: if (!empty($_POST["gedcom_config"])) $gedcom_config = $_POST["gedcom_config"];
63: else $gedcom_config = "config_gedcom.php";
64:}
65:
66:require($gedcom_config);

The both GET/POST requests will work even if PHP register_globals is Off.

Credits:
Cedric Cochin - netVigilance Vulnerability Research team

back to Security Advisories