CVE-2005-4318

An attacker sends an HTTP request to the Limbo CMS `index.php` or `index2.php` with query parameters `_SERVER[]` and `_SERVER[REMOTE_ADDR]` set to a malicious payload. Because `register_globals` is off, PHP allows the attacker to overwrite the `$_SERVER` superglobal array via the query string. The injected `_SERVER[REMOTE_ADDR]` value is not sanitized before being used in a SQL query, enabling blind SQL injection [ref_id=1]. The researcher demonstrates that this works regardless of `magic_quotes_gpc` settings because the `strip_magic_quotes()` function in `includes/initglobal.php` only processes `$_GET` and `$_POST`, not `$_SERVER` [ref_id=1]. The attack requires no authentication and only needs network access to the target web server.

The vulnerability lies in how Limbo CMS handles the `$_SERVER` superglobal array. The file `includes/initglobal.php` strips magic quotes from `$_GET` and `$_POST` but does not protect the `$_SERVER` array from being overwritten via query string parameters like `_SERVER[]` and `_SERVER[REMOTE_ADDR]`. The unsanitized `$_SERVER[REMOTE_ADDR]` value is then used directly in SQL queries (e.g., in the simple stats module) and in an `eval()` call within `classes/adodbt/read_table.php` at line 136-140 [ref_id=1].

No patch is included in the bundle. The advisory [ref_id=1] does not describe a vendor-supplied fix. Based on the root cause, remediation would require preventing user-supplied input from overwriting the `$_SERVER` superglobal array, and sanitizing or validating any `$_SERVER` values (such as `REMOTE_ADDR`) before using them in SQL queries or `eval()` calls. The advisory notes that the `strip_magic_quotes()` function in `includes/initglobal.php` only handles `$_GET` and `$_POST`, leaving `$_SERVER` unprotected — a complete fix would need to either block `_SERVER[]` from being accepted as a query parameter or add proper input validation for all `$_SERVER` values used in sensitive operations.

The following proof-of-concept URL demonstrates blind SQL injection via `_SERVER[REMOTE_ADDR]` overwrite [ref_id=1]:

``` http://[target]/[path]/index.php?_SERVER[]&_SERVER[REMOTE_ADDR]=999'UNION SELECT null,'<?php system($_G','ET[cmd]);?>' INTO DUMPFILE '[full_application_path]shell.php' FROM lm_simple_stats/*&option=weblinks&Itemid=999/* ```

For remote command execution via `eval()` injection, the researcher provides this URL [ref_id=1]:

``` http://[target]/[path_to_limbo]/index2.php?cmd=dir&_SERVER[]=&_SERVER[REMOTE_ADDR]='.system($_GET[cmd]).die('').'&option=wrapper&module[module]=1 ```

A full PHP exploit script is included in the reference write-up [ref_id=1] that automates the attack through an HTTP request with the crafted `_SERVER[]` and `_SERVER[REMOTE_ADDR]` parameters.