CVE-2005-0679 in Tell A Friend Script
Summary
by MITRE
PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code. NOTE: it was later reported that 2.4 is also affected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2017
The vulnerability described in CVE-2005-0679 represents a critical remote file inclusion flaw that affects the Tell A Friend Script version 2.7 and potentially earlier versions including 2.4. This issue resides within the tell_a_friend.inc.php component of the web application, which fails to properly validate or sanitize user-supplied input parameters. The vulnerability specifically targets the script_root parameter, which is used to determine the root directory path for the application's functionality. When an attacker manipulates this parameter to point to a remote web server hosting malicious PHP code, the application inadvertently includes and executes the remote code within the context of the web server.
This type of vulnerability falls under the category of CWE-88, known as "Improper Neutralization of Argument Delimiters in a Command," and more specifically aligns with CWE-94, "Improper Control of Generation of Code ('Code Injection')." The flaw enables attackers to perform remote code execution through the manipulation of file inclusion mechanisms, which is a fundamental security weakness in web applications that process user input without proper sanitization. The vulnerability demonstrates poor input validation practices where the application directly incorporates user-provided data into file path resolution without adequate security controls.
The operational impact of this vulnerability is severe as it allows remote attackers to execute arbitrary PHP code on the target system with the privileges of the web server process. This creates a complete compromise of the affected web application and potentially the entire server if proper isolation is not maintained. Attackers can leverage this vulnerability to upload backdoors, steal sensitive data, modify content, or use the compromised server as a staging point for further attacks within the network. The vulnerability is particularly dangerous because it requires no authentication and can be exploited through simple HTTP requests that modify the script_root parameter to point to malicious remote resources.
Mitigation strategies for this vulnerability include immediate patching of the Tell A Friend Script to version 20050305 or later, which contains the necessary security fixes. Organizations should implement input validation and sanitization measures to prevent user-supplied data from being used in file inclusion operations. The principle of least privilege should be applied by ensuring web server processes run with minimal required permissions. Additionally, the use of allow_url_include and allow_url_fopen directives should be disabled in php.ini configurations to prevent remote file inclusion attacks. Network-level protections such as web application firewalls and intrusion detection systems can help detect and block exploitation attempts. From an ATT&CK framework perspective, this vulnerability maps to T1190 "Exploit Public-Facing Application" and T1059 "Command and Scripting Interpreter" as attackers leverage the compromised application to execute malicious code remotely. Organizations should also consider implementing secure coding practices that prohibit direct user input from being used in dynamic file path construction, which would prevent similar vulnerabilities from occurring in the future.