Secunia

rgod has reported some vulnerabilities and a security issue in Php-Stats, which can be exploited by malicious people to conduct SQL injection attacks, disclose system and sensitive information, and compromise a vulnerable system.

1) Input passed to the "option[language]" and "option[template]" parameters in "admin.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

2) Input passed to the "option[prefix]" parameter in "admin.php" and the "PC_REMOTE_ADDR" HTTP header in "click.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled (except for the "option[prefix]" parameter).

3) An input validation error in "admin.php" can be exploited to inject arbitrary PHP code in "config.php".

4) The problem is that it is possible to disclose database table prefixes by accessing the "checktables.php" script.

The vulnerabilities and the security issue have been reported in version 0.1.9.1 and prior. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised and verified.
Further details available in Customer Area

Provided and/or discovered by
rgod

Changelog
Further details available in Customer Area

Original Advisory
http://retrogod.altervista.org/php_stats_0191_adv.html

Deep Links
Links available in Customer Area