Detections
Analytics
Traq admincp/common.php authenticate() Function Authentication Bypass Remote Code Execution
high Nessus Plugin ID 62892
Language:
Synopsis
The remote web server hosts an application that allows arbitrary code execution.Description
The version of Traq installed on the remote host contains a flaw that could allow a remote attacker to bypass the authentication mechanism and inject and execute arbitrary code. The flaw is caused by the application failing to properly restrict admin rights in the 'authenticate()' function in 'admincp/common.php'.Note that successful exploitation of this issue, such as by this plugin, results in a persistent change to the site. To undo this change, the 'traq_plugin_code' table of the MySQL database will need to be modified to remove the code added by this plugin.
Solution
Upgrade to version 2.3.1 or later.See Also
http://www.saintcorporation.com/cgi-bin/exploit_info/traq_authenticate
Plugin Details
Severity: High
ID: 62892
File Name: traq_authenticate_function_code_execution.nasl
Version: 1.9
Type: remote
Family: CGI abuses
Published: 11/12/2012
Updated: 4/11/2022
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus
Vulnerability Information
CPE: x-cpe:/a:traq:traq
Required KB Items: www/PHP, www/traq
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Patch Publication Date: 12/2/2011
Vulnerability Publication Date: 12/7/2011
Exploitable With
Metasploit (Traq admincp/common.php Remote Code Execution)
Elliot (Traq 2.3 RCE)
Reference Information
BID: 50961