Bugtraq mailing list archives
Re: Invision Vulnerabilities, including remote code execution
From: "Steven M. Christey" <coley () mitre org>
Date: Wed, 26 Apr 2006 15:41:24 -0400 (EDT)
sources/action_public/search.php line 1261 $this->output = preg_replace( "#(value=[\"']{$this->ipsclass->input['lastdate']}[\"'])#i", "\\1 selected='selected'", $this->output ); ... an #e modifier is added and then %00 used which will be parsed as a null byte and truncate the string thus removing the original )#i part.
This is a very interesting bug: modifying a regular expression in a way that accesses the execution functionality. In general, regexp hacking seems to be a fruitful area for research. As another example, null characters have been used to bypass security-relevant regexp checks. As "input validation" becomes more frequent, it seems likely that these kinds of vulns will be introduced more often. Other languages with rich regexp capabilities might be subject to similar issues. - Steve
Current thread:
- Invision Vulnerabilities, including remote code execution spam (Apr 25)
- <Possible follow-ups>
- Re: Invision Vulnerabilities, including remote code execution Steven M. Christey (Apr 26)
- RE: Invision Vulnerabilities, including remote code execution Mike Weller (Apr 30)
- Re: Invision Vulnerabilities, including remote code execution mattmecham (Apr 27)