Traq admincp/common.php authenticate() Function Authentication Bypass Remote Code Execution

high Nessus Plugin ID 62892

Language:

Synopsis

The remote web server hosts an application that allows arbitrary code execution.

Description

The version of Traq installed on the remote host contains a flaw that could allow a remote attacker to bypass the authentication mechanism and inject and execute arbitrary code. The flaw is caused by the application failing to properly restrict admin rights in the 'authenticate()' function in 'admincp/common.php'.

Note that successful exploitation of this issue, such as by this plugin, results in a persistent change to the site. To undo this change, the 'traq_plugin_code' table of the MySQL database will need to be modified to remove the code added by this plugin.

Solution

Upgrade to version 2.3.1 or later.

See Also

http://www.saintcorporation.com/cgi-bin/exploit_info/traq_authenticate

Plugin Details

Severity: High

ID: 62892

File Name: traq_authenticate_function_code_execution.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 11/12/2012

Updated: 4/11/2022

Configuration: Enable thorough checks

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:traq:traq

Required KB Items: www/traq, www/PHP

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 12/2/2011

Vulnerability Publication Date: 12/7/2011

Exploitable With

Metasploit (Traq admincp/common.php Remote Code Execution)

Elliot (Traq 2.3 RCE)

Reference Information

BID: 50961