ppp-design found the following design error in php-ping:


Details

Product: php-ping
Affected Version: (no version information included in the script)
Immune Version: latest version
OS affected: all OS with php
Vendor-URL: http://www.theworldsend.net/
Vendor-Status: informed, new version avaiable
Security-Risk: high - very high
Remote-Exploit: Yes


Introduction

php-ping is a simple php script executing the ping command. Unfortunately a bug allows users to execute arbritary commands.


More details

The problem is based upon the fact that not all user inputs are filtered correctly. Although $host is filtered using preg_replace the $count variable is parsed unfiltered to the system() command.


Proof-of-concept

You can use one of the following proof of concepts:

http://www.example.com/php-ping.php?count=1+%26+ls%20-l+%26&submit=Ping%21
http://www.example.com/php-ping.php?count=1+%26+cat%20/etc/passwd+%26&submit=Ping%21


Temporary-Fix

Replace
If ($count > $max_count)
with
If ($count > $max_count || !is_numeric($count))


Fix

Use latest version.


Security-Risk

Because an attacker is able to execute any php command, he is able to read all files including .htaccess or .htpasswd files or any password protected pages. Depending on system security he might be able to run any shell command on the server. That is why we are rating this security issue to high - very high.


Vendor status

Unfortunately the webmaster@theworldsend.net address mentioned on the website and in the script was bouncing. But with help of whois we were able to find a valid email address to contact the author. On day later, the bug was fixed without any notice.


Disclaimer

All information that can be found in this advisory is believed to be true, but maybe it isn't. ppp-design can not be held responsible for the use or missuse of this information. Redistribution of this text is only permitted if the text has not been altered and the original author ppp-design (http://www.ppp-design.de) is mentioned.