Secunia

rgod has reported some vulnerabilities in Php-Stats, which can be exploited by malicious people to conduct SQL injection attacks or compromise a vulnerable system.

1) Input passed to the "PC-REMOTE-ADDR" HTTP header in php-stats.recphp.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed to the "ip" parameter in php-stats.recphp.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that the "accept_ssi" option is enabled.

3) Input passed to "report_w_day" option is not properly sanitised before being stored in the /option/php-stats-options.php file. This can be exploited to inject and execute arbitrary PHP code.

Successful exploitation requires the administrator password, which can be gained by exploiting vulnerability #1 or #2.

The vulnerabilities are reported in version 0.1.9.1b. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
rgod

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/3496
http://milw0rm.com/exploits/3497
http://milw0rm.com/exploits/3502

Deep Links
Links available in Customer Area