1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
Rule:
--
Sid: 2143
--
Summary:
This event is generated when an attempt is made to exploit a weakness in the cafelog php application.
--
Impact:
Arbitrary code execution.
--
Detailed Information:
This event is generated when an attempt is made to exploit a vulnerability in the cafelog PHP application.
It is possible for an attacker to include a PHP file of his choosing via a URL, the script is processed and executed with the privileges of the user running the webserver. This is due to poor checking of user supplied variables in the gm-2-b2.php script.
--
Affected Systems:
Any host using cafelog.
--
Attack Scenarios:
An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script via gm-2-b2.php.
--
Ease of Attack:
Simple.
--
False Positives:
None Known.
--
False Negatives:
None Known.
--
Corrective Action:
Check the php implementation on the host.
Check the webserver log files for signs of this activity.
Where possible, ensure the webserver is run as an unprivileged process.
Check the host for signs of compromise.
--
Contributors:
Sourcefire Research Team
Brian Caswell <bmc@sourcefire.com>
Nigel Houghton <nigel.houghton@sourcefire.com>
--
Additional References:
--
|
