SimplePHPBlog has a vulnerability in its comment_delete_cgi.php.
The PHP script allows for the arbitrary deletion of files. Please see following link for a perl script to demonstrate the exploit: http://www.ftusecurity.com/pub/sphpblog_vulns (Please add .pl extension as my ISP server preprocesses the file if it is .pl or txt.) This vulnerability, in combination with the fact that the installation scripts are left on the server after installation, allows an arbitrary user to reset the admin password to one of the attacker's choosing. The script demonstrates the ability to delete files, reset the admin password to the attacker's choosing and upload files (including a command prompt). The exploit is for educational purposes only. To prevent this exploit change the line in comment_delete_cgi.php from $logged_in = logged_in( false, true ); to $logged_in = logged_in( true, true ); Sincerely, 'ken'@FTU Kenneth F. Belva, CISSP http://www.ftusecurity.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
