TUCoPS :: Web :: PHP :: bt374.txt

zenTrack Remote Command Execution Vulnerabilities

Subject: zenTrack Remote Command Execution Vulnerabilities

Author: farking (farking@i-ownur.info)

Product: zenTrack 2.4.1 (latest) and below

Vendor: http://zendocs.phpzen.net/zentrack / 


Status:  Vendor contacted (27/05/2003)

Location: http://farking.daemon.sh/advisories/zentrack-062003.txt

Greet to: corpsie & EvoIVGSR



zenTrack is a flexible system for tracking work, requests, information, 

and customer care. 

The goal of the project is to provide a method for organizing, managing, 

and archiving requests, work, and information 

in a structured and reliable method. 



zenTrack vulnerability exist in header.php that hold zenTrack 

configuration settings. Some code



  $libDir = "/web/zentrack/includes";

  $rootUrl = "http://www.yourhost.com/zentrack";

  $Debug_Mode = 0;

  $Demo_Mode = "off";

  $configFile = "$libDir/configVars.php";



This allow anyone to take advantage of this vulnerability and run remote 

command as webserver privilege. For example:




Create translator.class anywhere in your website contain php code that 

allow you to run command. For this example I'll 

create translator.class in the test directory:



If you dont wan't to see any error just copy translator.class as 

zenTrack.class :)

Other vulnerability is attacker can turn zenTrack demo mode to on or set 

zenTrack debug mode that will show extra info. 


farking (farking@i-ownur.info)


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH