install rce

[Inkqaqz]

my env：
Version 2.5
php 5.3.29
windows

At /install.php:90，user input was saved to /system/assistants/config.inc.php causing RCE

Create a new database named test";phpinfo();# and then visit /instll.php to install the website

Then visit /system/assistants/config.inc.php

[mikaelstaer]

Let me look into this.
I know other users have had issues trying to install on local...

[mikaelstaer]

@chan115117 Did anything get added to the database?

You can create the config file manually by creating config.inc.php in /system/assistants/

<?php
$settings['DB_SERVER']= "mysql_server_address";
$settings['DB_NAME']= "db_name";
$settings['DB_USERNAME']= "db_username";
$settings['DB_PASSWORD']= "db_password";


$settings['COOKIE_TIME']= "604800";
$settings['COOKIE_PATH']= "/";
$settings['COOKIE_DOMAIN']= ".";


$settings['SKIN']= "starling";
?>

[dbolkensteyn]

@mikaelstaer Just to be clear, this is a security issue leading to a Remote Code Execution vulnerability. A CVE has been published a few days ago: https://nvd.nist.gov/vuln/detail/CVE-2021-43479