Arbitrary File Disclosure Vulnerability in phpGedView 2.65.1 and prior
Current status
This advisory describes a vulnerability from 2004. It is not in the CISA Known Exploited Vulnerabilities catalog and there is no active remediation deadline. The page is kept online because other security databases link to it.
CVE reference CVE-2004-0127
In KEV catalog no
Affected software phpGedView version 2.65.1 and prior
Captured from netvigilance.com
Original document
Reproduced as it was published, including the advisory numbering, scoring and the disclosure timeline used at the time.
Description:
Directory traversal vulnerability in editconfig_gedcom.php for phpGedView 2.65.1 and earlier allows remote attackers to read arbitrary files or execute arbitrary PHP programs on the server via .. (dot dot) sequences in the gedcom_config parameter.
External References:
Mitre CVE: CVE-2004-0127
BUGTRAQ: 20040129 PHP Code Injection Vulnerabilities in phpGedView 2.65.1 and prior
Summary:
phpGedView is an open source system for online viewing of Gedcom information (family tree and genealogy information). Multiple PHP Code Injection vulnerabilities exist in the phpGedView product. They enable a malicious user to access any file on the server.
Release Date:
January 29 2004
Severity:
High
SecureScout Testcase ID:
TC 17867 (released Feb 6th)
Vulnerable Systems:
phpGedView version 2.65.1 and prior
Vulnerability Type:
Directory Traversal - Allowing the Attacker to read any file on the Target Server via the .. (dot dot) Sequence.
Vendor Status:
The Vendor has been notified and has Released a Version 2.65.3 that fixes the problem
Example:
(HIGH Risk BUT user must be Admin)
- -- HTTP Request --
http://[target]/[phpGedView-directory]/editconfig_gedcom.php?gedcom_config=../../../../../../etc/passwd
or
http://[target]/[phpGedView-directory]/editconfig_gedcom.php
POSTDATA: gedcom_config=../../../../../../etc/passwd
- -- HTTP Request --
Code impacted : editconfig_gedcom.php
61:if (empty($gedcom_config)) {
62: if (!empty($_POST["gedcom_config"])) $gedcom_config = $_POST["gedcom_config"];
63: else $gedcom_config = "config_gedcom.php";
64:}
65:
66:require($gedcom_config);
The both GET/POST requests will work even if PHP register_globals is Off.
Credits:
Cedric Cochin - netVigilance Vulnerability Research team Why this page still exists
Advisories published between 2004 and 2015 are referenced by vulnerability databases, academic papers and mailing list archives. Removing them would break those references, so every advisory keeps its original address and its original text. Nothing on this page has been rewritten to match current practice.