Secunia

m00fd1 has reported a vulnerability in the ePing plugin for e107, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "eping_cmd", "eping_host", and "eping_count" parameters in "doping.php" isn't properly sanitised before being used in a "system()" call. This can be exploited to inject arbitrary shell commands.

NOTE: The vulnerability in the "eping_cmd" and "eping_host" parameters has been fixed in version 1.02. However, OS2A has reported that version 1.02 is still vulnerable to command injection in the "eping_count" parameter.

Solution
Update to version 1.02 and edit the source code to ensure that input passed to the "eping_count" parameter is properly sanitised.

Provided and/or discovered by
Originally reported by:
m00fd1

Additional information:
OS2A

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area