TUCoPS :: HP Unsorted T :: bx6093.htm

TCPDF Library Remote Code Execution Vulnerability
TCPDF Library Remote Code Execution Vulnerability
TCPDF Library Remote Code Execution Vulnerability

Hash: SHA1

- --[ Product

TCPDF is an Open Source PHP class for generating PDF documents.
TCPDF project was started in 2002 and now it is freely used all
over the world by millions of people. TCPDF is a Free Libre Open
Source Software (FLOSS). -- http://www.tcpdf.org/ 

- --[ Vulnerability

Under certain circumstances, an intruder may be able to take
advantage of this flaw to execute arbitrary code with the
privileges of the web server.

To exploit this issue the application that is using TCPDF must be
vulnerable to cross-site scripting inside their pdf generating

The problem is caused by the TCPDF callback element that could be
injected into HTML code. The parsing of the callback element is
using the 'params' attribute inside an eval() statement without any

- --[ Affected Code

case 'tcpdf': {
  // NOT HTML: used to call TCPDF methods
  if (isset($tag['attribute']['method'])) {
    $tcpdf_method = $tag['attribute']['method'];
    if (method_exists($this, $tcpdf_method)) {
      if (isset($tag['attribute']['params']) AND
         (!empty($tag['attribute']['params']))) {

        eval('$params = array('.$this->unhtmlentities(

        call_user_func_array(array($this, $tcpdf_method),
      } else {
      $this->newline = true;

- --[ Proof of Concept

The injection of the following TCPDF callback element into HTML
code (that is processed by TCPDF) will exploit the issue:

- --[ Affected Versions

TCPDF versions from 4.5.036 (2009-04-03) to 4.9.005 (2010-04-01)
are vulnerable to this issue, version 4.9.006 (2010-04-02) fixes
the problem.

The new version introduced a configuration constant to disable the
TCPDF callback element: K_TCPDF_CALLS_IN_HTML (default: true)

- --[ Timeline

2010-04-02 -- Vendor notified
2010-04-02 -- Vendor reaction and security fix
2010-04-08 -- Public disclosure (with vendor permissions)

- --
(a) (p)roof (o)f (c)oncept ..

Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986- AOH