phpGraphy up to 0.9.13 config.php pictures[] memory corruption

Summaryinfo

A vulnerability described as critical has been identified in phpGraphy. Affected by this issue is some unknown functionality of the file config.php. Executing a manipulation of the argument pictures[] can lead to memory corruption. This vulnerability is handled as CVE-2006-6966. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in phpGraphy and classified as critical. This vulnerability affects an unknown code block of the file config.php. The manipulation of the argument pictures[] with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter s hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures[] parameter to index.php. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpGraphy.

The weakness was released 02/03/2007 (Website). The advisory is shared for download at sourceforge.net. This vulnerability was named CVE-2006-6966 since 02/03/2007. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

It is declared as functional. By approaching the search of inurl:config.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.9.13a eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (30634) and SecurityTracker (ID 1017571†). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• phpGraphy

Version

• 0.9
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8
• 0.9.9
• 0.9.9a
• 0.9.10
• 0.9.10a
• 0.9.11
• 0.9.12
• 0.9.13

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion