Wordtrans wordtrans-web wordtrans.php could be used to execute malicious code
| wordtrans-web-code-execution (10063) |  High Risk |
Description:
Wordtrans could allow a remote attacker to execute code on the server, caused by an input validation error in the wordtrans-web package, which is a PHP-based Web interface for Wordtrans. A remote attacker could pass malicious code within parameters to the wordtrans.php script, which would be executed on the affected system with privileges of the Web server process when the URL is submitted.
Platforms Affected:
- Debian, Debian Linux 2.2
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- WoltLab, Wordtrans 1.1pre9 and prior
Remedy:
Upgrade to the latest version of Wordtrans (1.1pre10 or later), available from the Wordtrans Web page. See References.
For Red Hat Linux 7.3:
Upgrade to the latest wordtrans package (1.1pre8-11 or later), as listed in RHSA-2002:188-08. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Guardent Client Advisory September 6, 2002, Guardent CLIENT ALERT - Multiple wordtrans-web Vulnerabilities at http://www.guardent.com/comp_news_wordtrans-web.html#.
- Wordtrans Web site, Multi Language Word Translator (wordtrans) at http://wordtrans.sourceforge.net/index.php?english=1.
- BID-5671: Wordtrans-web Remote Command Execution Vulnerability
- BID-5674: Wordtrans-web Script Injection Vulnerability
- CVE-2002-0837: wordtrans 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to (1) execute arbitrary code or (2) conduct cross-site scripting attacks via certain parameters (possibly dict) to the wordtrans.php script.
- RHSA-2002-188: New wordtrans packages fix remote vulnerabilities
Reported:
Sep 06, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net